34.34.218.106

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "production",
    "http_ua_hash": "892e30f5b31494a0976a25c97949a7020201f976",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "733a894b07d9b79b5b4ab7169336337873d659bc",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 217,
    "payload_entropy": 5.295004897022781,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "67393d75bc2da7ebbdce106afa81da6cede54196",
    "event_fingerprint": "f1782a253850a89bea33b08e5c2ec9f3e5800f86",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "8af8ab8befaab0e42ff59f3e0de9e0a5",
        "payload_hash": "f6188db78050e898e527b75abf9a9966",
        "path_pattern_hash": "d172a4f1c2b0f77cc0bf21a5051067d5"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko\/20",
    "method": "GET",
    "path": "\/private\/.env.production",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko\/20110622 Firefox\/6.0a2",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/private\/.env.production HTTP\/1.1",
    "request_sample": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko\/20110622 Firefox\/6.0a2\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko\/20",
    "evidence": {
        "method": "GET",
        "path": "\/private\/.env.production",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko\/20110622 Firefox\/6.0a2",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/private\/.env.production HTTP\/1.1",
        "request_sample": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko\/20110622 Firefox\/6.0a2\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko\/20",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "11ba98638c0a57e893fcdde408d9bfa95bb183e7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/private\/.env.production",
        "request_line": "GET \/private\/.env.production HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko\/20110622 Firefox\/6.0a2",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko\/20",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/.env.production",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/private\/.env.production",
            "request_line": "GET \/private\/.env.production HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko\/20110622 Firefox\/6.0a2",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/private\/.env.production",
        "evidence_snippet": "GET \/private\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko\/20",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_probe_private",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "local",
    "http_ua_hash": "d52ae5fd0587f0a8d63d73f658e4cfe1f696d2c4",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "8315d690f50358ceea64bc0cb23314dd9bf855ed",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 260,
    "payload_entropy": 5.399457629550522,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "976ff26e9b24f11c366be124fdcde623321568cb",
    "event_fingerprint": "aee520309c125784a181d8114fb23184696e29bf",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "34d1b3e31734a3b6e2d4550317d88d1a",
        "payload_hash": "c0c64620da7dbe1a29bab37874f8b433",
        "path_pattern_hash": "826e0f7bf5d8c36c7953b7184edfe839"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G930F) AppleWebKit\/537.3",
    "method": "GET",
    "path": "\/config\/.env.local",
    "user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G930F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/config\/.env.local HTTP\/1.1",
    "request_sample": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G930F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
    "payload_snippet": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G930F) AppleWebKit\/537.3",
    "evidence": {
        "method": "GET",
        "path": "\/config\/.env.local",
        "user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G930F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/config\/.env.local HTTP\/1.1",
        "request_sample": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G930F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close",
        "payload_snippet": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G930F) AppleWebKit\/537.3",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "07b9f1016fd7313872fc87aac755bdab1760accc",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/config\/.env.local",
        "request_line": "GET \/config\/.env.local HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G930F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/53\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G930F) AppleWebKit\/537.3",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/.env.local",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/config\/.env.local",
            "request_line": "GET \/config\/.env.local HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; SM-G930F) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/53\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/.env.local",
        "evidence_snippet": "GET \/config\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; SM-G930F) AppleWebKit\/537.3",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_probe_config",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "4111832ebe3597af454ce590f312702dd158237e",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "9afb54f0e738d3d8aa1fcfb80bab77080f7f6fdc",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 273,
    "payload_entropy": 5.36986107565677,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "66125a881070ff79f89077ed616292f673be6c55",
    "event_fingerprint": "1c34cac09fd3abd363f4722bed3fbe61b1a6e50d",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "fce8b2c5fa067b854db8ca48c513daa0",
        "payload_hash": "f44722dd545eebcbb0f59cef4f2bc216",
        "path_pattern_hash": "d9b00f587478dec270837253c672f652"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKi",
    "method": "GET",
    "path": "\/service\/.env",
    "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobile\/15E148 Safari\/605.1",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/service\/.env HTTP\/1.1",
    "request_sample": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobile\/15E148 Safari\/605.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
    "payload_snippet": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKi",
    "evidence": {
        "method": "GET",
        "path": "\/service\/.env",
        "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobile\/15E148 Safari\/605.1",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/service\/.env HTTP\/1.1",
        "request_sample": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobile\/15E148 Safari\/605.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
        "payload_snippet": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKi",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "000e3fce427ffc6a587d26506750fac2d85fe9c4",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/service\/.env",
        "request_line": "GET \/service\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobi\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKi",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/service\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/service\/.env",
            "request_line": "GET \/service\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.81 Mobi\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/service\/.env",
        "evidence_snippet": "GET \/service\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKi",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "production",
    "http_ua_hash": "67cd2aa88754575f856c2edf38d4b5159963a959",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "7ad14949ad0b183b675db2d36d2d5b72ec09f204",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 273,
    "payload_entropy": 5.3688587234642,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "66125a881070ff79f89077ed616292f673be6c55",
    "event_fingerprint": "47d50fc12c090da770511df295faae416ca38efe",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "57322d07efe3c4afc6e4b5dae3823bbb",
        "payload_hash": "4109172c09c309ad8772cc50a412a468",
        "path_pattern_hash": "211e3ccc5c91dea183ab66efa73c6a45"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 5 Plus) Appl",
    "method": "GET",
    "path": "\/services\/.env.production",
    "user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 5 Plus) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/services\/.env.production HTTP\/1.1",
    "request_sample": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 5 Plus) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
    "payload_snippet": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 5 Plus) Appl",
    "evidence": {
        "method": "GET",
        "path": "\/services\/.env.production",
        "user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 5 Plus) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/services\/.env.production HTTP\/1.1",
        "request_sample": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 5 Plus) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
        "payload_snippet": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 5 Plus) Appl",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "58d72de81328cecde6d646a8fbe99e525058d8c1",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/services\/.env.production",
        "request_line": "GET \/services\/.env.production HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 5 Plus) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Saf\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 5 Plus) Appl",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/.env.production",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/services\/.env.production",
            "request_line": "GET \/services\/.env.production HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 5 Plus) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Saf\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/.env.production",
        "evidence_snippet": "GET \/services\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.1.0; Redmi 5 Plus) Appl",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "fc4a269fbdd10d30d1815e1ec2628e6dfa45adfb",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "9bae73d08848be44521e9c4d49360c6e081f0fff",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 299,
    "payload_entropy": 5.516552098823365,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 70,
    "tag_count": 10,
    "anomaly_count": 0,
    "campaign_key": "5b20e677ae635f88a6f9f7a5157cb68bdbbf0563",
    "event_fingerprint": "1841577bddf320f11c9e03fd133f9a2b2938ba80",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0854",
        "pat-0341",
        "pat-0606"
    ],
    "matched_pattern_names": [
        "ET Magento admin",
        "ES admin GET",
        "ActiveMQ console"
    ],
    "pattern_ids": [
        "pat-0854",
        "pat-0341",
        "pat-0606"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 70,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "2033f96c32f9e7a32c72a9f0be492fee",
        "payload_hash": "751332616de5fc39845d8ee7334268d7",
        "path_pattern_hash": "36de7f489df887c3e31f5a951469f711"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 70
    },
    "payload_preview": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950U Build\/PPR1.180610.0",
    "method": "GET",
    "path": "\/admin\/.env",
    "user_agent": "Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950U Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/admin\/.env HTTP\/1.1",
    "request_sample": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950U Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nA",
    "payload_snippet": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950U Build\/PPR1.180610.0",
    "evidence": {
        "method": "GET",
        "path": "\/admin\/.env",
        "user_agent": "Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950U Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/admin\/.env HTTP\/1.1",
        "request_sample": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950U Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nA",
        "payload_snippet": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950U Build\/PPR1.180610.0",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4e9d6282bf2bb4930a4fd1545cb51a3fe3508e5f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/admin\/.env",
        "request_line": "GET \/admin\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950U Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBr\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950U Build\/PPR1.180610.0",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 70,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 70,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/admin\/.env",
            "request_line": "GET \/admin\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950U Build\/PPR1.180610.011) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBr\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/.env",
        "evidence_snippet": "GET \/admin\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G950U Build\/PPR1.180610.0",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_admin_panel_probe",
        "http_admin_panel_scan",
        "http_backup_file_scan",
        "http_probe_admin",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "backup",
    "http_ua_hash": "0102061f1ee3579e7a276e7c1b0c33df2da9f83a",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "32e03e003a51f542f710beeac8e15f008c3f65ad",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 257,
    "payload_entropy": 5.4431905348248035,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 70,
    "tag_count": 10,
    "anomaly_count": 0,
    "campaign_key": "5b20e677ae635f88a6f9f7a5157cb68bdbbf0563",
    "event_fingerprint": "85fb864943129595c48be5f08349f91c162fbd80",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "matched_patterns": [
        "pat-0854",
        "pat-0341",
        "pat-0606"
    ],
    "matched_pattern_names": [
        "ET Magento admin",
        "ES admin GET",
        "ActiveMQ console"
    ],
    "pattern_ids": [
        "pat-0854",
        "pat-0341",
        "pat-0606"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 70,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b03063e9427d04942eb42dbc8a9e6fd1",
        "payload_hash": "8bd7c2d49e43b1a398dd84991a90c73a",
        "path_pattern_hash": "9967aebe85bc5150552d43732fce77c0"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 70
    },
    "payload_preview": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/",
    "method": "GET",
    "path": "\/admin\/.env.backup",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/admin\/.env.backup HTTP\/1.1",
    "request_sample": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
    "payload_snippet": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/",
    "evidence": {
        "method": "GET",
        "path": "\/admin\/.env.backup",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/admin\/.env.backup HTTP\/1.1",
        "request_sample": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r",
        "payload_snippet": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bb0fe2f460c702af74cb5125510d4d4db9bb3d5a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/admin\/.env.backup",
        "request_line": "GET \/admin\/.env.backup HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/.env.backup",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 70,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 70,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/admin\/.env.backup",
            "request_line": "GET \/admin\/.env.backup HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/71.0.3578.98 Safari\/537.36",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/.env.backup",
        "evidence_snippet": "GET \/admin\/.env.backup HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_admin_panel_probe",
        "http_admin_panel_scan",
        "http_backup_file_scan",
        "http_probe_admin",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "39cf8711194d175dc249c64d89a5be41b73cbfc4",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "ce47452b1fa5a36e3e2ab6ad357d27ce11d38e66",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 219,
    "payload_entropy": 5.2087914738719325,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "635d1916832b75764dfd26d1846db7fcefa9686f",
    "event_fingerprint": "0bf3e0c77c23a4da5b215ce062bef0b796291dff",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "66677e2111bcaebb536729956fa2fae4",
        "payload_hash": "736124317d7cec42c545c5afac413e2a",
        "path_pattern_hash": "12e1063037a0428b03f9617844274d0a"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Opera\/9.80 (Android; Opera Mini\/7.6.40234\/151.113; U; en) Presto\/",
    "method": "GET",
    "path": "\/uploads\/.env",
    "user_agent": "Opera\/9.80 (Android; Opera Mini\/7.6.40234\/151.113; U; en) Presto\/2.12.423 Version\/12.16",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/uploads\/.env HTTP\/1.1",
    "request_sample": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Opera\/9.80 (Android; Opera Mini\/7.6.40234\/151.113; U; en) Presto\/2.12.423 Version\/12.16\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Opera\/9.80 (Android; Opera Mini\/7.6.40234\/151.113; U; en) Presto\/",
    "evidence": {
        "method": "GET",
        "path": "\/uploads\/.env",
        "user_agent": "Opera\/9.80 (Android; Opera Mini\/7.6.40234\/151.113; U; en) Presto\/2.12.423 Version\/12.16",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/uploads\/.env HTTP\/1.1",
        "request_sample": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Opera\/9.80 (Android; Opera Mini\/7.6.40234\/151.113; U; en) Presto\/2.12.423 Version\/12.16\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Opera\/9.80 (Android; Opera Mini\/7.6.40234\/151.113; U; en) Presto\/",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3f99103be1d38463c54633751127d7610088be2a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/uploads\/.env",
        "request_line": "GET \/uploads\/.env HTTP\/1.1",
        "http_user_agent": "Opera\/9.80 (Android; Opera Mini\/7.6.40234\/151.113; U; en) Presto\/2.12.423 Version\/12.16",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Opera\/9.80 (Android; Opera Mini\/7.6.40234\/151.113; U; en) Presto\/",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/uploads\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/uploads\/.env",
            "request_line": "GET \/uploads\/.env HTTP\/1.1",
            "http_user_agent": "Opera\/9.80 (Android; Opera Mini\/7.6.40234\/151.113; U; en) Presto\/2.12.423 Version\/12.16",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/uploads\/.env",
        "evidence_snippet": "GET \/uploads\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Opera\/9.80 (Android; Opera Mini\/7.6.40234\/151.113; U; en) Presto\/",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_probe_uploads",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "local",
    "http_ua_hash": "d34ba1c0d7773c05cce895702da8fecdd23012ac",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "73e333bd92670fab956ca02375108c7191056a36",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 254,
    "payload_entropy": 5.402907434622801,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "66125a881070ff79f89077ed616292f673be6c55",
    "event_fingerprint": "2808e74b2eac9d845649e164ed1c0a984d1217f4",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a35a0cfeaa81ff8bc3b1186aacc831df",
        "payload_hash": "fc00bdd337c803814d7b1358333cd940",
        "path_pattern_hash": "8f696125de1c497ec1d3172258a9f00b"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
    "method": "GET",
    "path": "\/services\/.env.local",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99  Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/services\/.env.local HTTP\/1.1",
    "request_sample": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99  Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
    "evidence": {
        "method": "GET",
        "path": "\/services\/.env.local",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99  Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/services\/.env.local HTTP\/1.1",
        "request_sample": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99  Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fa95459e8445c11af31cf40dde715e44077afae1",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/services\/.env.local",
        "request_line": "GET \/services\/.env.local HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99  Safari\/537.36",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/.env.local",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/services\/.env.local",
            "request_line": "GET \/services\/.env.local HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/67.0.3396.99  Safari\/537.36",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/services\/.env.local",
        "evidence_snippet": "GET \/services\/.env.local HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "d3ec33057ed3d25555673619b3058b2b2abc5c74",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "3f4c975c51cd1d3df84592564ed06afe4e782992",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 295,
    "payload_entropy": 5.5059219880735135,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "66125a881070ff79f89077ed616292f673be6c55",
    "event_fingerprint": "111df5b87d7b0723729778acbf5bd623ebf5f530",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "0f6550512083838b94b52e34547dc5ea",
        "payload_hash": "e2071dc30665870dd1e5224aa1a274ac",
        "path_pattern_hash": "93883cb09f4769a367badfafc907183e"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/release\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build\/R16NW) ",
    "method": "GET",
    "path": "\/release\/.env",
    "user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/release\/.env HTTP\/1.1",
    "request_sample": "GET \/release\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccep",
    "payload_snippet": "GET \/release\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build\/R16NW)",
    "evidence": {
        "method": "GET",
        "path": "\/release\/.env",
        "user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/release\/.env HTTP\/1.1",
        "request_sample": "GET \/release\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/9.4 Chrome\/67.0.3396.87 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccep",
        "payload_snippet": "GET \/release\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build\/R16NW)",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b004329b926c44ac0b135e819e7b416d1f6e7901",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/release\/.env",
        "request_line": "GET \/release\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/release\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build\/R16NW)",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/release\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/release\/.env",
            "request_line": "GET \/release\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build\/R16NW) AppleWebKit\/537.36 (KHTML, like Gecko) SamsungBrowser\/\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/release\/.env",
        "evidence_snippet": "GET \/release\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SAMSUNG SM-G935F Build\/R16NW)",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "79fcf70203b529772ca6088bc07c51a2a51bfd2e",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "25e9d50bacd292841afcec6b93bcba6a1f6790d4",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 232,
    "payload_entropy": 5.390545852575736,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 88,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.5,
    "risk_breakdown": {
        "waf": 88,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 65,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "8eef256905a35b9f293da5c0257b1692db0f41ab",
    "event_fingerprint": "5348e4900239ee0daf627f2149b2c5f22344156b",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 88,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 65,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "97e0dfaa21a6dc89a019c31181340a71",
        "payload_hash": "64717a23869b04e604c1efaed08dfc36",
        "path_pattern_hash": "8432e822d78216a6822b5a443dbf894c"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 65
    },
    "payload_preview": "GET \/portal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0) AppleWebKit\/537.36 (KHTML, like Gecko",
    "method": "GET",
    "path": "\/portal\/.env",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.93 Safari\/537.36",
    "waf_tags": [
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/portal\/.env HTTP\/1.1",
    "request_sample": "GET \/portal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.93 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/portal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0) AppleWebKit\/537.36 (KHTML, like Gecko",
    "evidence": {
        "method": "GET",
        "path": "\/portal\/.env",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.93 Safari\/537.36",
        "waf_tags": [
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/portal\/.env HTTP\/1.1",
        "request_sample": "GET \/portal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.93 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/portal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0) AppleWebKit\/537.36 (KHTML, like Gecko",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8ff83d00b07f1ed674820510d5229baafc2314c0",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/portal\/.env",
        "request_line": "GET \/portal\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.93 Safari\/537.36",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/portal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0) AppleWebKit\/537.36 (KHTML, like Gecko",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/portal\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab nosqli-3 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 88,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 65,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 65,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/portal\/.env",
            "request_line": "GET \/portal\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.93 Safari\/537.36",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/portal\/.env",
        "evidence_snippet": "GET \/portal\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.0) AppleWebKit\/537.36 (KHTML, like Gecko",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "fa25cf184358545398838fb77bdddd73118551ca",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "83c0a8815eca606b22325f7ae33170918a4904ee",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 242,
    "payload_entropy": 5.421324534118835,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "66125a881070ff79f89077ed616292f673be6c55",
    "event_fingerprint": "5b3248f93d2e519a0630179bf91ee6463f8b0fd5",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cb829f6ee9845f59bdf3dddbb78114ee",
        "payload_hash": "253c95e9b13be32721bc46c0a078beab",
        "path_pattern_hash": "202848a338e2a8411edbe9c852ffc90f"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, ",
    "method": "GET",
    "path": "\/cms\/.env",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.81 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/cms\/.env HTTP\/1.1",
    "request_sample": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.81 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
    "evidence": {
        "method": "GET",
        "path": "\/cms\/.env",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.81 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/cms\/.env HTTP\/1.1",
        "request_sample": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.81 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "10538a2c34fcb29834842fdf6d67091212b66707",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/cms\/.env",
        "request_line": "GET \/cms\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.81 Safari\/537.36",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cms\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/cms\/.env",
            "request_line": "GET \/cms\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.81 Safari\/537.36",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cms\/.env",
        "evidence_snippet": "GET \/cms\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "62c7a4f561331db55e9d732ac42a3e6a3b0a6719",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "a0df23adcbc250d22f3ea9c43cd45132cd7d119e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 159,
    "payload_entropy": 5.192997614290639,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 92,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 92,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "f743b3b9847d5d90a4c9fabd6c06e8b16955a04c",
    "event_fingerprint": "054255215b8f4e237c775bbb815947f83e267f6a",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 92,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "80c7a2ec952a92279503d16dd31aeb9d",
        "payload_hash": "5ad35f7fdd8795a8a27a69ef038ffaa6",
        "path_pattern_hash": "90b830636acb1be7da7ed46e94f3bb1d"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.2 (Windows; N)\r\nAccept-Charset: utf-8\r\nAccept-Encodi",
    "method": "GET",
    "path": "\/dashboard\/.env",
    "user_agent": "iTunes\/9.0.2 (Windows; N)",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/dashboard\/.env HTTP\/1.1",
    "request_sample": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.2 (Windows; N)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.2 (Windows; N)\r\nAccept-Charset: utf-8\r\nAccept-Encodi",
    "evidence": {
        "method": "GET",
        "path": "\/dashboard\/.env",
        "user_agent": "iTunes\/9.0.2 (Windows; N)",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/dashboard\/.env HTTP\/1.1",
        "request_sample": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.2 (Windows; N)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.2 (Windows; N)\r\nAccept-Charset: utf-8\r\nAccept-Encodi",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f0dab198bf5590a39c593923162b29109928d72f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/dashboard\/.env",
        "request_line": "GET \/dashboard\/.env HTTP\/1.1",
        "http_user_agent": "iTunes\/9.0.2 (Windows; N)",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.2 (Windows; N)\r\nAccept-Charset: utf-8\r\nAccept-Encodi",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dashboard\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 92,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/dashboard\/.env",
            "request_line": "GET \/dashboard\/.env HTTP\/1.1",
            "http_user_agent": "iTunes\/9.0.2 (Windows; N)",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dashboard\/.env",
        "evidence_snippet": "GET \/dashboard\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.2 (Windows; N)\r\nAccept-Charset: utf-8\r\nAccept-Encodi",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_probe_traefik",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "0f1d058165a26c2e9f851b5c13977896d23b479a",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "88f51b1ca7bef99bb6c035fd80f97ade7f3602a8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 273,
    "payload_entropy": 5.405956831753677,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "66125a881070ff79f89077ed616292f673be6c55",
    "event_fingerprint": "3b0209bf883ab83138cceca2fd3b6a75d8e14c7a",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a18a6d841dd0637034e27efb82cbacf9",
        "payload_hash": "0c118ab3cdb89918e946161e4a9ec8bc",
        "path_pattern_hash": "cf92621b9e3f2982786aa63fff3e305e"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/deploy\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit",
    "method": "GET",
    "path": "\/deploy\/.env",
    "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.123 Mobile\/15E148 Safari\/605.1",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/deploy\/.env HTTP\/1.1",
    "request_sample": "GET \/deploy\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.123 Mobile\/15E148 Safari\/605.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
    "payload_snippet": "GET \/deploy\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit",
    "evidence": {
        "method": "GET",
        "path": "\/deploy\/.env",
        "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.123 Mobile\/15E148 Safari\/605.1",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/deploy\/.env HTTP\/1.1",
        "request_sample": "GET \/deploy\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.123 Mobile\/15E148 Safari\/605.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConn",
        "payload_snippet": "GET \/deploy\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c67534be2cf7fad519e25e3722c3e7f0fe75c198",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/deploy\/.env",
        "request_line": "GET \/deploy\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.123 Mob\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/deploy\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/deploy\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/deploy\/.env",
            "request_line": "GET \/deploy\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/76.0.3809.123 Mob\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/deploy\/.env",
        "evidence_snippet": "GET \/deploy\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "14628cd4a4abd0e3e10c609d18773a8555cc5390",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "7f1fb2a1c5b72e520b988cd8c8a970a6662732b5",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 249,
    "payload_entropy": 5.423688662529115,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "66125a881070ff79f89077ed616292f673be6c55",
    "event_fingerprint": "e3e6813e70c0635ef71e75488870f6902e82a6c2",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "dbb58d3bccfa92958e04f2c811e70647",
        "payload_hash": "8545d0d688284dba24a7027f2246673d",
        "path_pattern_hash": "0d0f9087dce4407a1a8d5052b0a9d1bf"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/var\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (K",
    "method": "GET",
    "path": "\/var\/.env",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/var\/.env HTTP\/1.1",
    "request_sample": "GET \/var\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/var\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (K",
    "evidence": {
        "method": "GET",
        "path": "\/var\/.env",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/var\/.env HTTP\/1.1",
        "request_sample": "GET \/var\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/var\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (K",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "aa32fdd5b724ae9196da1dbd7d1d6d82acc142a1",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/var\/.env",
        "request_line": "GET \/var\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/var\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (K",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/var\/.env",
            "request_line": "GET \/var\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.142 Safari\/537.\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/var\/.env",
        "evidence_snippet": "GET \/var\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 (K",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "6d10ed516e2c23ca8f7bde0be44e14eb0b92730a",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "81857e1267b33a1f581fba5ddd161461d38f8919",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 275,
    "payload_entropy": 5.364720302425989,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "66125a881070ff79f89077ed616292f673be6c55",
    "event_fingerprint": "53b505596a891fcf0e0bd242dedd4dde94696586",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "7523c5d32d67d6334420581b77fccf10",
        "payload_hash": "6de4778dc92c1f0725e8d9c9bd176771",
        "path_pattern_hash": "66871996c0444a7924edba6da98b9137"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/dist\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) Appl",
    "method": "GET",
    "path": "\/dist\/.env",
    "user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/dist\/.env HTTP\/1.1",
    "request_sample": "GET \/dist\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nCo",
    "payload_snippet": "GET \/dist\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) Appl",
    "evidence": {
        "method": "GET",
        "path": "\/dist\/.env",
        "user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/dist\/.env HTTP\/1.1",
        "request_sample": "GET \/dist\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 Mobile\/5A347 Safari\/525.200\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nCo",
        "payload_snippet": "GET \/dist\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) Appl",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fa8a673c4a9bfadc41a245ef8b4901302cb2074a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/dist\/.env",
        "request_line": "GET \/dist\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 \u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/dist\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) Appl",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dist\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/dist\/.env",
            "request_line": "GET \/dist\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) AppleWebKit\/525.18.1 (KHTML, like Gecko) Version\/3.1.1 \u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dist\/.env",
        "evidence_snippet": "GET \/dist\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; U; CPU iPhone OS 2_0 like Mac OS X; en-us) Appl",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 239,
    "payload_entropy": 5.833077337896281,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http-alt-8081",
    "app_proto": "http-alt-8081",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 8,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "adc18765dea9c033662210f3040e4e075e5b4f7c",
    "event_fingerprint": "299e4481712667d3cd006e5867e01c563a8c7863",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8081",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8cad183b203cc57657a162ccf0e1b440",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8081,
        "service": "http-alt-8081",
        "service_name": "http-alt-8081",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003_\ufffd\ufffdMSk\ufffd\ufffd{\ufffd\u0006b\ufffd\ufffd\ufffd]\"N$\ufffd\ufffdE\ufffdS\ufffd,\ufffd}\u0006 \ufffd\ufffd\ufffd%\b\u02c4\ufffd\ufffd\ufffd\ufffdxV[O\ufffdx\ufffd\ufffd\ufffd\ufffd6\u672e\u0004\ufffd#)\ufffd\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003_\ufffd\ufffdMSk\ufffd\ufffd{\ufffd\u0006b\ufffd\ufffd\ufffd]\"N$\ufffd\ufffdE\ufffdS\ufffd,\ufffd}\u0006 \ufffd\ufffd\ufffd%\b\u02c4\ufffd\ufffd\ufffd\ufffdxV[O\ufffdx\ufffd\ufffd\ufffd\ufffd6\u672e\u0004\ufffd#)\ufffd\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0314\ufffd\ufffd~\ufffdA\u0018ey\ufffd\ufffd\u00ae\ufffd'\u0004\ufffd=\ufffd\u073b\ufffd\u0001\u0007\ufffdy(\u001d5s=",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003_\ufffd\ufffdMSk\ufffd\ufffd{\ufffd\u0006b\ufffd\ufffd\ufffd]\"N$\ufffd\ufffdE\ufffdS\ufffd,\ufffd}\u0006 \ufffd\ufffd\ufffd%\b\u02c4\ufffd\ufffd\ufffd\ufffdxV[O\ufffdx\ufffd\ufffd\ufffd\ufffd6\u672e\u0004\ufffd#)\ufffd\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d6982962c8f093f15230efd045bc8e896a7299b0",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003_\ufffd\ufffdMSk\ufffd\ufffd{\ufffd\u0006b\ufffd\ufffd\ufffd]\"N$\ufffd\ufffdE\ufffdS\ufffd,\ufffd}\u0006 \ufffd\ufffd\ufffd%\b\u02c4\ufffd\ufffd\ufffd\ufffdxV[O\ufffdx\ufffd\ufffd\ufffd\ufffd6\u672e\u0004\ufffd#)\ufffd\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8081,
        "service": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081"
    },
    "evidence_snippet": "\ufffd\ufffd_\ufffd\ufffdMSk\ufffd\ufffd{\ufffdb\ufffd\ufffd\ufffd]\"N$\ufffd\ufffdE\ufffdS\ufffd,\ufffd} \ufffd\ufffd\ufffd%\u02c4\ufffd\ufffd\ufffd\ufffdxV[O\ufffdx\ufffd\ufffd\ufffd\ufffd6\u672e\ufffd#)\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
    "target_port_label": "8081 \u00b7 HTTP ALT 8081",
    "emulator_service": "http-alt-8081",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 42,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8081",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003_\ufffd\ufffdMSk\ufffd\ufffd{\ufffd\u0006b\ufffd\ufffd\ufffd]\"N$\ufffd\ufffdE\ufffdS\ufffd,\ufffd}\u0006 \ufffd\ufffd\ufffd%\b\u02c4\ufffd\ufffd\ufffd\ufffdxV[O\ufffdx\ufffd\ufffd\ufffd\ufffd6\u672e\u0004\ufffd#)\ufffd\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8081,
            "service": "http-alt-8081",
            "service_label_fr": "HTTP ALT 8081"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd_\ufffd\ufffdMSk\ufffd\ufffd{\ufffdb\ufffd\ufffd\ufffd]\"N$\ufffd\ufffdE\ufffdS\ufffd,\ufffd} \ufffd\ufffd\ufffd%\u02c4\ufffd\ufffd\ufffd\ufffdxV[O\ufffdx\ufffd\ufffd\ufffd\ufffd6\u672e\ufffd#)\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8081 \u00b7 HTTP ALT 8081",
        "emulator_service": "http-alt-8081",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8081",
        "service_banner": "honeypot-http-alt-8081",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 239,
    "payload_entropy": 5.8433864840059755,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http-alt-8081",
    "app_proto": "http-alt-8081",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 8,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "adc18765dea9c033662210f3040e4e075e5b4f7c",
    "event_fingerprint": "299e4481712667d3cd006e5867e01c563a8c7863",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8081",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c5052c6880b524929b6f633faaaf0c94",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8081,
        "service": "http-alt-8081",
        "service_name": "http-alt-8081",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdM\ufffd\b-X\ufffd\/PC$a\ufffdf\ufffd\ufffd`\ufffdu\ufffd1&\ue96d\ufffd\ufffd\ufffd\u0007i\u05dc Y\ufffd&\ufffd?\ufffd\ufffd5g\ufffd\u0010\ufffd\ufffd\ufffd\ufffdb\u000b\ufffd\/&,\/\ufffd\ufffdH\ufffd3\u04ae\ufffdI3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdM\ufffd\b-X\ufffd\/PC$a\ufffdf\ufffd\ufffd`\ufffdu\ufffd1&\ue96d\ufffd\ufffd\ufffd\u0007i\u05dc Y\ufffd&\ufffd?\ufffd\ufffd5g\ufffd\u0010\ufffd\ufffd\ufffd\ufffdb\u000b\ufffd\/&,\/\ufffd\ufffdH\ufffd3\u04ae\ufffdI3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u02fd\ufffdv\ufffd\u076aZh\ufffd\ufffd2\ufffd.\ufffd\ufffd\ufffd\ufffd\u00d8g(\n#\ufffd\ufffd\u0006(`~",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdM\ufffd\b-X\ufffd\/PC$a\ufffdf\ufffd\ufffd`\ufffdu\ufffd1&\ue96d\ufffd\ufffd\ufffd\u0007i\u05dc Y\ufffd&\ufffd?\ufffd\ufffd5g\ufffd\u0010\ufffd\ufffd\ufffd\ufffdb\u000b\ufffd\/&,\/\ufffd\ufffdH\ufffd3\u04ae\ufffdI3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b49b28cc84f4e086f949b95538dffbab9b091994",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdM\ufffd\b-X\ufffd\/PC$a\ufffdf\ufffd\ufffd`\ufffdu\ufffd1&\ue96d\ufffd\ufffd\ufffd\u0007i\u05dc Y\ufffd&\ufffd?\ufffd\ufffd5g\ufffd\u0010\ufffd\ufffd\ufffd\ufffdb\u000b\ufffd\/&,\/\ufffd\ufffdH\ufffd3\u04ae\ufffdI3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8081,
        "service": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdM\ufffd-X\ufffd\/PC$a\ufffdf\ufffd\ufffd`\ufffdu\ufffd1&\ue96d\ufffd\ufffd\ufffdi\u05dc Y\ufffd&\ufffd?\ufffd\ufffd5g\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\/&,\/\ufffd\ufffdH\ufffd3\u04ae\ufffdI3&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
    "target_port_label": "8081 \u00b7 HTTP ALT 8081",
    "emulator_service": "http-alt-8081",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 42,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8081",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdM\ufffd\b-X\ufffd\/PC$a\ufffdf\ufffd\ufffd`\ufffdu\ufffd1&\ue96d\ufffd\ufffd\ufffd\u0007i\u05dc Y\ufffd&\ufffd?\ufffd\ufffd5g\ufffd\u0010\ufffd\ufffd\ufffd\ufffdb\u000b\ufffd\/&,\/\ufffd\ufffdH\ufffd3\u04ae\ufffdI3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8081,
            "service": "http-alt-8081",
            "service_label_fr": "HTTP ALT 8081"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdM\ufffd-X\ufffd\/PC$a\ufffdf\ufffd\ufffd`\ufffdu\ufffd1&\ue96d\ufffd\ufffd\ufffdi\u05dc Y\ufffd&\ufffd?\ufffd\ufffd5g\ufffd\ufffd\ufffd\ufffd\ufffdb\ufffd\/&,\/\ufffd\ufffdH\ufffd3\u04ae\ufffdI3&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8081 \u00b7 HTTP ALT 8081",
        "emulator_service": "http-alt-8081",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8081",
        "service_banner": "honeypot-http-alt-8081",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 239,
    "payload_entropy": 5.8856662296922835,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http-alt-8081",
    "app_proto": "http-alt-8081",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 8,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "adc18765dea9c033662210f3040e4e075e5b4f7c",
    "event_fingerprint": "299e4481712667d3cd006e5867e01c563a8c7863",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8081",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d2e513fe4ecf5f19ef3fa7243d3e1dd7",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8081,
        "service": "http-alt-8081",
        "service_name": "http-alt-8081",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003GOG\u0003\u0017\ufffd\u0017l\ufffd,\ufffd:\ufffd\\n\ufffd m\ufffd\ufffd9\ufffd\ufffd\bd\ufffdhy\ufffd\ufffd\ufffd\u0015 _\ufffd\ufffd\ufffd';\ud2e0\ufffdW\ufffd\ufffd{5!K`\ufffd\b\ufffda\u0004\ufffd`\ufffd\ufffd\u050c\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003GOG\u0003\u0017\ufffd\u0017l\ufffd,\ufffd:\ufffd\\n\ufffd m\ufffd\ufffd9\ufffd\ufffd\bd\ufffdhy\ufffd\ufffd\ufffd\u0015 _\ufffd\ufffd\ufffd';\ud2e0\ufffdW\ufffd\ufffd{5!K`\ufffd\b\ufffda\u0004\ufffd`\ufffd\ufffd\u050c\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 2\ufffd\ufffd\ufffd\u035e\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd.\ufffd\ufffd[p\ufffd\ufffdV4&\ufffd\u0005\ufffd\ufffdi\u000f\ufffdO",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003GOG\u0003\u0017\ufffd\u0017l\ufffd,\ufffd:\ufffd\\n\ufffd m\ufffd\ufffd9\ufffd\ufffd\bd\ufffdhy\ufffd\ufffd\ufffd\u0015 _\ufffd\ufffd\ufffd';\ud2e0\ufffdW\ufffd\ufffd{5!K`\ufffd\b\ufffda\u0004\ufffd`\ufffd\ufffd\u050c\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "86657a2c21465af66dd735fa7ec19895c969c9cc",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003GOG\u0003\u0017\ufffd\u0017l\ufffd,\ufffd:\ufffd\\n\ufffd m\ufffd\ufffd9\ufffd\ufffd\bd\ufffdhy\ufffd\ufffd\ufffd\u0015 _\ufffd\ufffd\ufffd';\ud2e0\ufffdW\ufffd\ufffd{5!K`\ufffd\b\ufffda\u0004\ufffd`\ufffd\ufffd\u050c\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8081,
        "service": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081"
    },
    "evidence_snippet": "\ufffd\ufffdGOG\ufffdl\ufffd,\ufffd:\ufffd\\n\ufffd m\ufffd\ufffd9\ufffd\ufffdd\ufffdhy\ufffd\ufffd\ufffd _\ufffd\ufffd\ufffd';\ud2e0\ufffdW\ufffd\ufffd{5!K`\ufffd\ufffda\ufffd`\ufffd\ufffd\u050c\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
    "target_port_label": "8081 \u00b7 HTTP ALT 8081",
    "emulator_service": "http-alt-8081",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 42,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8081",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003GOG\u0003\u0017\ufffd\u0017l\ufffd,\ufffd:\ufffd\\n\ufffd m\ufffd\ufffd9\ufffd\ufffd\bd\ufffdhy\ufffd\ufffd\ufffd\u0015 _\ufffd\ufffd\ufffd';\ud2e0\ufffdW\ufffd\ufffd{5!K`\ufffd\b\ufffda\u0004\ufffd`\ufffd\ufffd\u050c\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8081,
            "service": "http-alt-8081",
            "service_label_fr": "HTTP ALT 8081"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdGOG\ufffdl\ufffd,\ufffd:\ufffd\\n\ufffd m\ufffd\ufffd9\ufffd\ufffdd\ufffdhy\ufffd\ufffd\ufffd _\ufffd\ufffd\ufffd';\ud2e0\ufffdW\ufffd\ufffd{5!K`\ufffd\ufffda\ufffd`\ufffd\ufffd\u050c\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8081 \u00b7 HTTP ALT 8081",
        "emulator_service": "http-alt-8081",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8081",
        "service_banner": "honeypot-http-alt-8081",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 239,
    "payload_entropy": 5.917438041258222,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http-alt-8081",
    "app_proto": "http-alt-8081",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 8,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "adc18765dea9c033662210f3040e4e075e5b4f7c",
    "event_fingerprint": "299e4481712667d3cd006e5867e01c563a8c7863",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8081",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fbd291cd22ec01121d8c8c46d9043545",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8081,
        "service": "http-alt-8081",
        "service_name": "http-alt-8081",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH6)\ufffd\ufffd,I\ufffd\ufffd`H\ufffd<.RP$\ufffd\u0003\u0010;\ufffd\ufffd\u0516\ufffdZ\ufffd\ufffd7\ufffd \\\ufffdS\ufffd\ufffd\ufffd\u0019Ui\ufffd\u0491\ufffd,\ufffd\ufffdQ\ufffdq\ufffd\ufffd\u0017\ufffd\u0006\ufffd4\ufffd@#=\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH6)\ufffd\ufffd,I\ufffd\ufffd`H\ufffd<.RP$\ufffd\u0003\u0010;\ufffd\ufffd\u0516\ufffdZ\ufffd\ufffd7\ufffd \\\ufffdS\ufffd\ufffd\ufffd\u0019Ui\ufffd\u0491\ufffd,\ufffd\ufffdQ\ufffdq\ufffd\ufffd\u0017\ufffd\u0006\ufffd4\ufffd@#=\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffdQg\ufffd\ufffdD\ufffd\ufffdk\ufffd(\ufffdC\ufffdQ`\ufffdlI\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffdP\ufffd\ufffds",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH6)\ufffd\ufffd,I\ufffd\ufffd`H\ufffd<.RP$\ufffd\u0003\u0010;\ufffd\ufffd\u0516\ufffdZ\ufffd\ufffd7\ufffd \\\ufffdS\ufffd\ufffd\ufffd\u0019Ui\ufffd\u0491\ufffd,\ufffd\ufffdQ\ufffdq\ufffd\ufffd\u0017\ufffd\u0006\ufffd4\ufffd@#=\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "47314f0c84e7333800b1aaefd57db35658cbee7d",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH6)\ufffd\ufffd,I\ufffd\ufffd`H\ufffd<.RP$\ufffd\u0003\u0010;\ufffd\ufffd\u0516\ufffdZ\ufffd\ufffd7\ufffd \\\ufffdS\ufffd\ufffd\ufffd\u0019Ui\ufffd\u0491\ufffd,\ufffd\ufffdQ\ufffdq\ufffd\ufffd\u0017\ufffd\u0006\ufffd4\ufffd@#=\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8081,
        "service": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdH6)\ufffd\ufffd,I\ufffd\ufffd`H\ufffd<.RP$\ufffd;\ufffd\ufffd\u0516\ufffdZ\ufffd\ufffd7\ufffd \\\ufffdS\ufffd\ufffd\ufffdUi\ufffd\u0491\ufffd,\ufffd\ufffdQ\ufffdq\ufffd\ufffd\ufffd\ufffd4\ufffd@#=\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
    "target_port_label": "8081 \u00b7 HTTP ALT 8081",
    "emulator_service": "http-alt-8081",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 42,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8081",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH6)\ufffd\ufffd,I\ufffd\ufffd`H\ufffd<.RP$\ufffd\u0003\u0010;\ufffd\ufffd\u0516\ufffdZ\ufffd\ufffd7\ufffd \\\ufffdS\ufffd\ufffd\ufffd\u0019Ui\ufffd\u0491\ufffd,\ufffd\ufffdQ\ufffdq\ufffd\ufffd\u0017\ufffd\u0006\ufffd4\ufffd@#=\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8081,
            "service": "http-alt-8081",
            "service_label_fr": "HTTP ALT 8081"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdH6)\ufffd\ufffd,I\ufffd\ufffd`H\ufffd<.RP$\ufffd;\ufffd\ufffd\u0516\ufffdZ\ufffd\ufffd7\ufffd \\\ufffdS\ufffd\ufffd\ufffdUi\ufffd\u0491\ufffd,\ufffd\ufffdQ\ufffdq\ufffd\ufffd\ufffd\ufffd4\ufffd@#=\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8081 \u00b7 HTTP ALT 8081",
        "emulator_service": "http-alt-8081",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8081",
        "service_banner": "honeypot-http-alt-8081",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 239,
    "payload_entropy": 5.8849090140163085,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http-alt-8081",
    "app_proto": "http-alt-8081",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 8,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "adc18765dea9c033662210f3040e4e075e5b4f7c",
    "event_fingerprint": "299e4481712667d3cd006e5867e01c563a8c7863",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8081",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8be54a4098dae84878ac5b19d3e96190",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8081,
        "service": "http-alt-8081",
        "service_name": "http-alt-8081",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\u000b\ufffd\u0017Um#m\ufffd\ufffd\ufffdy\ufffd\bd\ufffd\ufffd^\\\ufffd\ufffd\ufffd,r\ufffd\u0002vT\u0003 \ufffd)\ufffd\ufffd\ufffd)n~\ufffd' j\ufffd\u0429\ufffd\u0017\u05f2\ufffd\u0335l\ufffd\ufffd[\ufffd\u0245\ufffdM\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\u000b\ufffd\u0017Um#m\ufffd\ufffd\ufffdy\ufffd\bd\ufffd\ufffd^\\\ufffd\ufffd\ufffd,r\ufffd\u0002vT\u0003 \ufffd)\ufffd\ufffd\ufffd)n~\ufffd' j\ufffd\u0429\ufffd\u0017\u05f2\ufffd\u0335l\ufffd\ufffd[\ufffd\u0245\ufffdM\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 ;\ufffd!6\ufffd\ufffd\ufffd?|\u001aWc\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd)\ufffd*B\ufffd\ufffdMA.\ufffd-N2",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\u000b\ufffd\u0017Um#m\ufffd\ufffd\ufffdy\ufffd\bd\ufffd\ufffd^\\\ufffd\ufffd\ufffd,r\ufffd\u0002vT\u0003 \ufffd)\ufffd\ufffd\ufffd)n~\ufffd' j\ufffd\u0429\ufffd\u0017\u05f2\ufffd\u0335l\ufffd\ufffd[\ufffd\u0245\ufffdM\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "62ff3728d5c05b3af0d4bbd34392189da0fa7e76",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\u000b\ufffd\u0017Um#m\ufffd\ufffd\ufffdy\ufffd\bd\ufffd\ufffd^\\\ufffd\ufffd\ufffd,r\ufffd\u0002vT\u0003 \ufffd)\ufffd\ufffd\ufffd)n~\ufffd' j\ufffd\u0429\ufffd\u0017\u05f2\ufffd\u0335l\ufffd\ufffd[\ufffd\u0245\ufffdM\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8081,
        "service": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdX\ufffd\ufffdUm#m\ufffd\ufffd\ufffdy\ufffdd\ufffd\ufffd^\\\ufffd\ufffd\ufffd,r\ufffdvT \ufffd)\ufffd\ufffd\ufffd)n~\ufffd' j\ufffd\u0429\ufffd\u05f2\ufffd\u0335l\ufffd\ufffd[\ufffd\u0245\ufffdM\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
    "target_port_label": "8081 \u00b7 HTTP ALT 8081",
    "emulator_service": "http-alt-8081",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 42,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8081",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdX\ufffd\u000b\ufffd\u0017Um#m\ufffd\ufffd\ufffdy\ufffd\bd\ufffd\ufffd^\\\ufffd\ufffd\ufffd,r\ufffd\u0002vT\u0003 \ufffd)\ufffd\ufffd\ufffd)n~\ufffd' j\ufffd\u0429\ufffd\u0017\u05f2\ufffd\u0335l\ufffd\ufffd[\ufffd\u0245\ufffdM\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8081,
            "service": "http-alt-8081",
            "service_label_fr": "HTTP ALT 8081"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdX\ufffd\ufffdUm#m\ufffd\ufffd\ufffdy\ufffdd\ufffd\ufffd^\\\ufffd\ufffd\ufffd,r\ufffdvT \ufffd)\ufffd\ufffd\ufffd)n~\ufffd' j\ufffd\u0429\ufffd\u05f2\ufffd\u0335l\ufffd\ufffd[\ufffd\u0245\ufffdM\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8081 \u00b7 HTTP ALT 8081",
        "emulator_service": "http-alt-8081",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8081",
        "service_banner": "honeypot-http-alt-8081",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 239,
    "payload_entropy": 5.801644852803378,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http-alt-8081",
    "app_proto": "http-alt-8081",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 8,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "adc18765dea9c033662210f3040e4e075e5b4f7c",
    "event_fingerprint": "299e4481712667d3cd006e5867e01c563a8c7863",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8081",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c8e5f28cce47347cf75ac3647ac76fe5",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8081,
        "service": "http-alt-8081",
        "service_name": "http-alt-8081",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\b\ufffd\ufffd\u03f3\ufffdub\u0003\ufffd\ufffd\ufffd\u0015;\u02ebK~\ufffdHQ\ufffd\u0007iB\u0434\ufffd:\u001d:o Q\u00e7\ufffd\u0013-~\u0002\ufffd0\ufffdY\ufffd\ufffd\ufffd\u0002\ufffd\ufffd(2\u0017\u0010|\ufffd{2\u000f\u000b\ufffdd\u0013\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\b\ufffd\ufffd\u03f3\ufffdub\u0003\ufffd\ufffd\ufffd\u0015;\u02ebK~\ufffdHQ\ufffd\u0007iB\u0434\ufffd:\u001d:o Q\u00e7\ufffd\u0013-~\u0002\ufffd0\ufffdY\ufffd\ufffd\ufffd\u0002\ufffd\ufffd(2\u0017\u0010|\ufffd{2\u000f\u000b\ufffdd\u0013\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdJ\ufffd\ufffd}\"h\ufffd\u001f@\ufffd]+g*\ufffdl\ufffd\ufffd\ufffdh\u0017L\ufffd.~\ufffd97\ufffd0{",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\b\ufffd\ufffd\u03f3\ufffdub\u0003\ufffd\ufffd\ufffd\u0015;\u02ebK~\ufffdHQ\ufffd\u0007iB\u0434\ufffd:\u001d:o Q\u00e7\ufffd\u0013-~\u0002\ufffd0\ufffdY\ufffd\ufffd\ufffd\u0002\ufffd\ufffd(2\u0017\u0010|\ufffd{2\u000f\u000b\ufffdd\u0013\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dc92b7fd999f545115776c2172d0eeb880752d29",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\b\ufffd\ufffd\u03f3\ufffdub\u0003\ufffd\ufffd\ufffd\u0015;\u02ebK~\ufffdHQ\ufffd\u0007iB\u0434\ufffd:\u001d:o Q\u00e7\ufffd\u0013-~\u0002\ufffd0\ufffdY\ufffd\ufffd\ufffd\u0002\ufffd\ufffd(2\u0017\u0010|\ufffd{2\u000f\u000b\ufffdd\u0013\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8081,
        "service": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u03f3\ufffdub\ufffd\ufffd\ufffd;\u02ebK~\ufffdHQ\ufffdiB\u0434\ufffd::o Q\u00e7\ufffd-~\ufffd0\ufffdY\ufffd\ufffd\ufffd\ufffd\ufffd(2|\ufffd{2\ufffdd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
    "target_port_label": "8081 \u00b7 HTTP ALT 8081",
    "emulator_service": "http-alt-8081",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 42,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8081",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\b\ufffd\ufffd\u03f3\ufffdub\u0003\ufffd\ufffd\ufffd\u0015;\u02ebK~\ufffdHQ\ufffd\u0007iB\u0434\ufffd:\u001d:o Q\u00e7\ufffd\u0013-~\u0002\ufffd0\ufffdY\ufffd\ufffd\ufffd\u0002\ufffd\ufffd(2\u0017\u0010|\ufffd{2\u000f\u000b\ufffdd\u0013\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8081,
            "service": "http-alt-8081",
            "service_label_fr": "HTTP ALT 8081"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\u03f3\ufffdub\ufffd\ufffd\ufffd;\u02ebK~\ufffdHQ\ufffdiB\u0434\ufffd::o Q\u00e7\ufffd-~\ufffd0\ufffdY\ufffd\ufffd\ufffd\ufffd\ufffd(2|\ufffd{2\ufffdd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8081 \u00b7 HTTP ALT 8081",
        "emulator_service": "http-alt-8081",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8081",
        "service_banner": "honeypot-http-alt-8081",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 239,
    "payload_entropy": 5.900058906215872,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http-alt-8081",
    "app_proto": "http-alt-8081",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 8,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "adc18765dea9c033662210f3040e4e075e5b4f7c",
    "event_fingerprint": "299e4481712667d3cd006e5867e01c563a8c7863",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8081",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "79f3edb241e11beef696edc132b7a3bd",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8081,
        "service": "http-alt-8081",
        "service_name": "http-alt-8081",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~9\ufffd\ufffdepP\ufffdX\rM\u001f\uf90atQ\"\ufffd\ufffd\ufffd(\ufffd*f\u0012\ufffdGn\ufffd o\ufffd*\u001f\u037fh%\ufffd\ufffd\ufffd\ufffddA\u0010\ufffdIM\ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd=\u00a2M\ufffd*\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~9\ufffd\ufffdepP\ufffdX\rM\u001f\uf90atQ\"\ufffd\ufffd\ufffd(\ufffd*f\u0012\ufffdGn\ufffd o\ufffd*\u001f\u037fh%\ufffd\ufffd\ufffd\ufffddA\u0010\ufffdIM\ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd=\u00a2M\ufffd*\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001bq\ufffd_a\u0002Cc,\ufffd\r\ufffd\ufffd\u0778\ufffd\ufffd0\ufffd\u001bg\ufffd\ufffd'G\u0017\ufffd\ufffd`\ufffdcD",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~9\ufffd\ufffdepP\ufffdX\rM\u001f\uf90atQ\"\ufffd\ufffd\ufffd(\ufffd*f\u0012\ufffdGn\ufffd o\ufffd*\u001f\u037fh%\ufffd\ufffd\ufffd\ufffddA\u0010\ufffdIM\ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd=\u00a2M\ufffd*\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a73a71834336e80095da5819d4653044194a40af",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~9\ufffd\ufffdepP\ufffdX\rM\u001f\uf90atQ\"\ufffd\ufffd\ufffd(\ufffd*f\u0012\ufffdGn\ufffd o\ufffd*\u001f\u037fh%\ufffd\ufffd\ufffd\ufffddA\u0010\ufffdIM\ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd=\u00a2M\ufffd*\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8081,
        "service": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081"
    },
    "evidence_snippet": "\ufffd\ufffd~9\ufffd\ufffdepP\ufffdX\rM\uf90atQ\"\ufffd\ufffd\ufffd(\ufffd*f\ufffdGn\ufffd o\ufffd*\u037fh%\ufffd\ufffd\ufffd\ufffddA\ufffdIM\ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd=\u00a2M\ufffd*&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
    "target_port_label": "8081 \u00b7 HTTP ALT 8081",
    "emulator_service": "http-alt-8081",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 42,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8081",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~9\ufffd\ufffdepP\ufffdX\rM\u001f\uf90atQ\"\ufffd\ufffd\ufffd(\ufffd*f\u0012\ufffdGn\ufffd o\ufffd*\u001f\u037fh%\ufffd\ufffd\ufffd\ufffddA\u0010\ufffdIM\ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd=\u00a2M\ufffd*\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8081,
            "service": "http-alt-8081",
            "service_label_fr": "HTTP ALT 8081"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd~9\ufffd\ufffdepP\ufffdX\rM\uf90atQ\"\ufffd\ufffd\ufffd(\ufffd*f\ufffdGn\ufffd o\ufffd*\u037fh%\ufffd\ufffd\ufffd\ufffddA\ufffdIM\ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd=\u00a2M\ufffd*&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8081 \u00b7 HTTP ALT 8081",
        "emulator_service": "http-alt-8081",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8081",
        "service_banner": "honeypot-http-alt-8081",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 239,
    "payload_entropy": 5.84188215669349,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http-alt-8081",
    "app_proto": "http-alt-8081",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 8,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 45,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "adc18765dea9c033662210f3040e4e075e5b4f7c",
    "event_fingerprint": "299e4481712667d3cd006e5867e01c563a8c7863",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 42,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8081",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "69dfa1d9723e6e1fc31b81ee5fd6379f",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "ja4": "7b5e3a15097abc10f88e98257ea51010",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-18-43-51,29-23-24-25,0",
    "tls_ja4_hash": "7b5e3a15097abc10f88e98257ea51010",
    "tls_ja4": "t13d0119_86cb3216d275_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 8081,
        "service": "http-alt-8081",
        "service_name": "http-alt-8081",
        "risk_score": 45
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd&a\ufffd\ufffd\u0016\u001b\ufffd\ufffd\ufffd\ufffd\ufffdl\u001cCFo\ufffd\u0007\u0002\u0003\ufffd\ufffd\ufffd\ufffd@\u06d5\ufffd\ufffd \u0795\ufffd\u04be \ufffd\u001a\ufffd\ufffd\ufffd\u0013\ufffdYCG\ufffd\b\ufffd\ufffd\ufffdKX\ufffd(\ufffdn\ufffdv\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd&a\ufffd\ufffd\u0016\u001b\ufffd\ufffd\ufffd\ufffd\ufffdl\u001cCFo\ufffd\u0007\u0002\u0003\ufffd\ufffd\ufffd\ufffd@\u06d5\ufffd\ufffd \u0795\ufffd\u04be \ufffd\u001a\ufffd\ufffd\ufffd\u0013\ufffdYCG\ufffd\b\ufffd\ufffd\ufffdKX\ufffd(\ufffdn\ufffdv\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000f\ufffdND}\ufffd\u0015$\u00135\ufffd\ufffd;\ufffdA\u001f\u0168?\ud922\udee3\u0001\ufffd\ufffd\ufffdsS\u0001\u0015",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd&a\ufffd\ufffd\u0016\u001b\ufffd\ufffd\ufffd\ufffd\ufffdl\u001cCFo\ufffd\u0007\u0002\u0003\ufffd\ufffd\ufffd\ufffd@\u06d5\ufffd\ufffd \u0795\ufffd\u04be \ufffd\u001a\ufffd\ufffd\ufffd\u0013\ufffdYCG\ufffd\b\ufffd\ufffd\ufffdKX\ufffd(\ufffdn\ufffdv\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0ae468e23d0258fc5737719093e88ef5746e3261",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd&a\ufffd\ufffd\u0016\u001b\ufffd\ufffd\ufffd\ufffd\ufffdl\u001cCFo\ufffd\u0007\u0002\u0003\ufffd\ufffd\ufffd\ufffd@\u06d5\ufffd\ufffd \u0795\ufffd\u04be \ufffd\u001a\ufffd\ufffd\ufffd\u0013\ufffdYCG\ufffd\b\ufffd\ufffd\ufffdKX\ufffd(\ufffdn\ufffdv\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
        "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
        "port": 8081,
        "service": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd&a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdlCFo\ufffd\ufffd\ufffd\ufffd\ufffd@\u06d5\ufffd\ufffd \u0795\ufffd\u04be \ufffd\ufffd\ufffd\ufffd\ufffdYCG\ufffd\ufffd\ufffd\ufffdKX\ufffd(\ufffdn\ufffdv\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
    "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
    "target_port_label": "8081 \u00b7 HTTP ALT 8081",
    "emulator_service": "http-alt-8081",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 42,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "http-alt-8081",
        "service_label_fr": "HTTP ALT 8081",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8081",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd&a\ufffd\ufffd\u0016\u001b\ufffd\ufffd\ufffd\ufffd\ufffdl\u001cCFo\ufffd\u0007\u0002\u0003\ufffd\ufffd\ufffd\ufffd@\u06d5\ufffd\ufffd \u0795\ufffd\u04be \ufffd\u001a\ufffd\ufffd\ufffd\u0013\ufffdYCG\ufffd\b\ufffd\ufffd\ufffdKX\ufffd(\ufffdn\ufffdv\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "19e29534fd49dd27d09234e639c4057e",
            "tls_ja4": "7b5e3a15097abc10f88e98257ea51010",
            "port": 8081,
            "service": "http-alt-8081",
            "service_label_fr": "HTTP ALT 8081"
        },
        "attack_vector": "postgres probe \u00b7 via HTTP ALT 8081:8081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd&a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdlCFo\ufffd\ufffd\ufffd\ufffd\ufffd@\u06d5\ufffd\ufffd \u0795\ufffd\u04be \ufffd\ufffd\ufffd\ufffd\ufffdYCG\ufffd\ufffd\ufffd\ufffdKX\ufffd(\ufffdn\ufffdv\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\nw",
        "target_port_label": "8081 \u00b7 HTTP ALT 8081",
        "emulator_service": "http-alt-8081",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8081",
        "service_banner": "honeypot-http-alt-8081",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "production",
    "http_ua_hash": "a0c35500139610980f7a1f193c23db1a70c0f647",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "9f1a3b476954729097b55b44dc605e9187baaeeb",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 276,
    "payload_entropy": 5.390806049908077,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "78222e64ad50e78467413bbc46b7fb125471217a",
    "event_fingerprint": "0e1fd1c95197f07561cb93fe18d40a3c17d1b4fb",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "cf74f83e3a6bd53f6198c8c8d261e678",
        "payload_hash": "39fb61354c1718cbbbfca9c802a914fd",
        "path_pattern_hash": "129b91fce99c27e6763c24ece35d5295"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/app\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI3",
    "method": "GET",
    "path": "\/app\/.env.production",
    "user_agent": "Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.10  (KHTML, like Gecko) Version\/3.0.4 Mobile Safari\/523.12.2",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/app\/.env.production HTTP\/1.1",
    "request_sample": "GET \/app\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.10  (KHTML, like Gecko) Version\/3.0.4 Mobile Safari\/523.12.2\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nC",
    "payload_snippet": "GET \/app\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI3",
    "evidence": {
        "method": "GET",
        "path": "\/app\/.env.production",
        "user_agent": "Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.10  (KHTML, like Gecko) Version\/3.0.4 Mobile Safari\/523.12.2",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/app\/.env.production HTTP\/1.1",
        "request_sample": "GET \/app\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.10  (KHTML, like Gecko) Version\/3.0.4 Mobile Safari\/523.12.2\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nC",
        "payload_snippet": "GET \/app\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI3",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d60c9f2f0573d49ef7a357071b14c72a7846cdc9",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/app\/.env.production",
        "request_line": "GET \/app\/.env.production HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.10  (KHTML, like Gecko) Version\/3.0.4 Mobi\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/app\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI3",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.env.production",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/app\/.env.production",
            "request_line": "GET \/app\/.env.production HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI39) AppleWebKit\/525.10  (KHTML, like Gecko) Version\/3.0.4 Mobi\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/.env.production",
        "evidence_snippet": "GET \/app\/.env.production HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 3.0; en-us; Xoom Build\/HRI3",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "0259b0a6e9b661df49adf36e35aad2ba1cf30207",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "95dbd9173b5580a94a3583c1e8d31bee303be7a7",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 174,
    "payload_entropy": 5.220556571054537,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 92,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 92,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "a7c859464272ee208d1663f11ab84264ae88b9ee",
    "event_fingerprint": "626833d6dbf536c4af468261fe8ca23b158df585",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 92,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 66,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "23cef6c3f06394596e11a276d5422da4",
        "payload_hash": "8308a09d113b0e0f0d93df47c62f1185",
        "path_pattern_hash": "5776ea19ec2f88a0568ff0bc7de6e909"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 66
    },
    "payload_preview": "GET \/dev\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (PSP (PlayStation Portable); 2.00)\r\nAccept-Charset: utf-8",
    "method": "GET",
    "path": "\/dev\/.env",
    "user_agent": "Mozilla\/4.0 (PSP (PlayStation Portable); 2.00)",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/dev\/.env HTTP\/1.1",
    "request_sample": "GET \/dev\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (PSP (PlayStation Portable); 2.00)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/dev\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (PSP (PlayStation Portable); 2.00)\r\nAccept-Charset: utf-8",
    "evidence": {
        "method": "GET",
        "path": "\/dev\/.env",
        "user_agent": "Mozilla\/4.0 (PSP (PlayStation Portable); 2.00)",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/dev\/.env HTTP\/1.1",
        "request_sample": "GET \/dev\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (PSP (PlayStation Portable); 2.00)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/dev\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (PSP (PlayStation Portable); 2.00)\r\nAccept-Charset: utf-8",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "da3512e463ac946a3f27213d109d2725aca9f4c0",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/dev\/.env",
        "request_line": "GET \/dev\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/4.0 (PSP (PlayStation Portable); 2.00)",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/dev\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (PSP (PlayStation Portable); 2.00)\r\nAccept-Charset: utf-8",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dev\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 92,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 66,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 66,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/dev\/.env",
            "request_line": "GET \/dev\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/4.0 (PSP (PlayStation Portable); 2.00)",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/dev\/.env",
        "evidence_snippet": "GET \/dev\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (PSP (PlayStation Portable); 2.00)\r\nAccept-Charset: utf-8",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_probe_dev",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "7d2313fa392f5eb512ba0a5a936b92daaa251e8b",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "8c6c0cf35b21182c44d1fbe7c55901c2e77c5cbc",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 199,
    "payload_entropy": 5.291555948534714,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "fd7e1935b5d262d0c606fca738546e2bb841f16a",
    "event_fingerprint": "279d32b3b77f21920fd8ff0b8b48b6ab9d5234dd",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "bcb4de9272c041662c2a554016ffd8f1",
        "payload_hash": "9ecedd138d68c5ef3e190f943d09cfb6",
        "path_pattern_hash": "b9266b5e3818db8e42f016e0af085277"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko\/20100101 Firefox\/41",
    "method": "GET",
    "path": "\/v3\/.env",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko\/20100101 Firefox\/41.0",
    "waf_tags": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/v3\/.env HTTP\/1.1",
    "request_sample": "GET \/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko\/20100101 Firefox\/41.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko\/20100101 Firefox\/41",
    "evidence": {
        "method": "GET",
        "path": "\/v3\/.env",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko\/20100101 Firefox\/41.0",
        "waf_tags": [
            "950316:lfi-14",
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/v3\/.env HTTP\/1.1",
        "request_sample": "GET \/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko\/20100101 Firefox\/41.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko\/20100101 Firefox\/41",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "34670440683917ed1e27ff978ef4473dc569d393",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/v3\/.env",
        "request_line": "GET \/v3\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko\/20100101 Firefox\/41.0",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko\/20100101 Firefox\/41",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v3\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/v3\/.env",
            "request_line": "GET \/v3\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko\/20100101 Firefox\/41.0",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v3\/.env",
        "evidence_snippet": "GET \/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko\/20100101 Firefox\/41",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "3f73a7f33f4f62ced1d755ef71435edcc6631816",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "7702579be3ca2d14cb80324c6a749f13cc1e6ce1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 194,
    "payload_entropy": 5.225754787949491,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "78222e64ad50e78467413bbc46b7fb125471217a",
    "event_fingerprint": "bf5ee3213094137ca8e5d483a1a61adf9196a656",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "825c68563898946855af22abf7cd370f",
        "payload_hash": "860132308e91b7c5c199e773981c4313",
        "path_pattern_hash": "e986d9a8713d4af4d188b7a61ad378ee"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/prod\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; rv:20.0) Gecko\/20121202 Firefox\/20.0\r\nA",
    "method": "GET",
    "path": "\/prod\/.env",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:20.0) Gecko\/20121202 Firefox\/20.0",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/prod\/.env HTTP\/1.1",
    "request_sample": "GET \/prod\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; rv:20.0) Gecko\/20121202 Firefox\/20.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/prod\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; rv:20.0) Gecko\/20121202 Firefox\/20.0\r\nA",
    "evidence": {
        "method": "GET",
        "path": "\/prod\/.env",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:20.0) Gecko\/20121202 Firefox\/20.0",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/prod\/.env HTTP\/1.1",
        "request_sample": "GET \/prod\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; rv:20.0) Gecko\/20121202 Firefox\/20.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/prod\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; rv:20.0) Gecko\/20121202 Firefox\/20.0\r\nA",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6b1bbd4eafe3a7156f0c03042da896138d1639a3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/prod\/.env",
        "request_line": "GET \/prod\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:20.0) Gecko\/20121202 Firefox\/20.0",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/prod\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; rv:20.0) Gecko\/20121202 Firefox\/20.0\r\nA",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/prod\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/prod\/.env",
            "request_line": "GET \/prod\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.2; rv:20.0) Gecko\/20121202 Firefox\/20.0",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/prod\/.env",
        "evidence_snippet": "GET \/prod\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; rv:20.0) Gecko\/20121202 Firefox\/20.0\r\nA",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "b5219f197fa37f9a176e16ea3a66d5e9fb587f43",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "8197cec9b1d84f19de1c5b10c28917030b9542e4",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 245,
    "payload_entropy": 5.349708431467917,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "9e8461701c0ca6aea55f41490fa8de39015e9874",
    "event_fingerprint": "90dfa9c9a0634cb03a8cf444a53064e97708a5ca",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "379e3f73ea0b0c7d993340f8397a3672",
        "payload_hash": "0c1295b5645f491cd2cfced8f19c026d",
        "path_pattern_hash": "a0f6f48aed881c23044b32112fcbe5cd"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/test\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KH",
    "method": "GET",
    "path": "\/test\/.env",
    "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/test\/.env HTTP\/1.1",
    "request_sample": "GET \/test\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/test\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KH",
    "evidence": {
        "method": "GET",
        "path": "\/test\/.env",
        "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/test\/.env HTTP\/1.1",
        "request_sample": "GET \/test\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/test\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KH",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "60e080b986b60cfbee9fcd3cbb936acaedd3ed67",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/test\/.env",
        "request_line": "GET \/test\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/test\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KH",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/test\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/test\/.env",
            "request_line": "GET \/test\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KHTML, like Gecko) Chrome\/19.0.1063.0 Safari\/536.3",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/test\/.env",
        "evidence_snippet": "GET \/test\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit\/536.3 (KH",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_probe_test",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "env",
    "http_ua_hash": "274b056f9e791be0da5d562e0f0f807646550eaa",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "cc4b30112d6bf6eb67e9d97dbf1e56d5dce1ab0e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 252,
    "payload_entropy": 5.480380011392442,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 70,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "c41c5ac483f215c69cbdd9ba457f751d45b7623d",
    "event_fingerprint": "7e6688b5cd2c056955ba49cec7a4ed3fde1f6b44",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 185,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0213"
    ],
    "matched_pattern_names": [
        "Probe \/api\/v2\/"
    ],
    "pattern_ids": [
        "pat-0213"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 70,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "58f4a91a3133aa8b769252f43327c46e",
        "payload_hash": "45773456e7160fe8fe3cc0c97764a4e2",
        "path_pattern_hash": "45a8106651a0a44c3f11053706f8aead"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 70
    },
    "payload_preview": "GET \/api\/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
    "method": "GET",
    "path": "\/api\/v2\/.env",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.85 Safari\/537.36 OPR\/32.0.1948.25",
    "waf_tags": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "nosqli-3",
        "leak-1",
        "k8s-api"
    ],
    "request_line": "GET \/api\/v2\/.env HTTP\/1.1",
    "request_sample": "GET \/api\/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.85 Safari\/537.36 OPR\/32.0.1948.25\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/api\/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
    "evidence": {
        "method": "GET",
        "path": "\/api\/v2\/.env",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.85 Safari\/537.36 OPR\/32.0.1948.25",
        "waf_tags": [
            "950316:lfi-14",
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "nosqli-3",
            "leak-1",
            "k8s-api"
        ],
        "request_line": "GET \/api\/v2\/.env HTTP\/1.1",
        "request_sample": "GET \/api\/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.85 Safari\/537.36 OPR\/32.0.1948.25\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/api\/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e8019fbf2e7368dd7414c3c0d54074371712101d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/api\/v2\/.env",
        "request_line": "GET \/api\/v2\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.85 Safari\/537.36 OPR\/32.0.1948.\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/api\/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/v2\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 70,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 70,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/api\/v2\/.env",
            "request_line": "GET \/api\/v2\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/45.0.2454.85 Safari\/537.36 OPR\/32.0.1948.\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/v2\/.env",
        "evidence_snippet": "GET \/api\/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api",
        "http_api_route_probe",
        "http_backup_file_scan",
        "http_probe_api",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "e9d0567dec6e67f36347e506d447c3912ab7bda2",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "737ca670329de18dc663a9b1a810e4d99c607cf0",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.27113299531273,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 92,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 20,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 92,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 86,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "74d1cce08090fa98b3b929c677cedf0bde5f2edb",
    "event_fingerprint": "1c64d0605761ad9a6444b2f28cc612ea638c6599",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 92,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 86,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "47a9c7a51a4cdc95c8753b8e179575b0",
        "payload_hash": "642a05a02dc1f479f5eb300deeef5d97",
        "path_pattern_hash": "25b2f069e3141e0796938ca9e4e845aa"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 86
    },
    "payload_preview": "GET \/stage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)\r\nAcce",
    "method": "GET",
    "path": "\/stage\/.env",
    "user_agent": "Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/stage\/.env HTTP\/1.1",
    "request_sample": "GET \/stage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/stage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)\r\nAcce",
    "evidence": {
        "method": "GET",
        "path": "\/stage\/.env",
        "user_agent": "Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/stage\/.env HTTP\/1.1",
        "request_sample": "GET \/stage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/stage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)\r\nAcce",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "block",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "348429d1a41a6fd49b7b8b285175d5a9163c99a3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/stage\/.env",
        "request_line": "GET \/stage\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/stage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)\r\nAcce",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/stage\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 86\/100 (Critique) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 92,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 86,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 86,
        "risk_label": "Critique",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "block",
        "recommended_action_label": "Bloquer (recommand\u00e9)",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/stage\/.env",
            "request_line": "GET \/stage\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/stage\/.env",
        "evidence_snippet": "GET \/stage\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)\r\nAcce",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_block",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_metasploit_ua",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "bak",
    "http_ua_hash": "228093dfc8613d5849462c5a76e09e1ed546d775",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "db58915b70ec4f4897682eec5a7fd50dc2102271",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 267,
    "payload_entropy": 5.487550936447077,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 70,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "a26d7c9500e13f0927829a01fb2a7a3b5af8f6a7",
    "event_fingerprint": "82a639218be8fc9a3e3179874c7c9cf39c1e3810",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 70,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "2672f4668bf1c319d541ae1310315577",
        "payload_hash": "c404b8365c2fd722c692455281823672",
        "path_pattern_hash": "704472054da186f49a4245e261c91fda"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 70
    },
    "payload_preview": "GET \/api\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWebKi",
    "method": "GET",
    "path": "\/api\/.env.bak",
    "user_agent": "Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/59.0.3071.125 Mobile Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950521:leak-8",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1",
        "leak-8",
        "k8s-api"
    ],
    "request_line": "GET \/api\/.env.bak HTTP\/1.1",
    "request_sample": "GET \/api\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/59.0.3071.125 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection",
    "payload_snippet": "GET \/api\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWebKi",
    "evidence": {
        "method": "GET",
        "path": "\/api\/.env.bak",
        "user_agent": "Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/59.0.3071.125 Mobile Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1",
            "950521:leak-8",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1",
            "leak-8",
            "k8s-api"
        ],
        "request_line": "GET \/api\/.env.bak HTTP\/1.1",
        "request_sample": "GET \/api\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/59.0.3071.125 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection",
        "payload_snippet": "GET \/api\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWebKi",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7303bdb4c41d63b062259a28ca50eeaaa3419cac",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/api\/.env.bak",
        "request_line": "GET \/api\/.env.bak HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/59.0.3071.125 Mobi\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/api\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWebKi",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env.bak",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 70,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 70,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/api\/.env.bak",
            "request_line": "GET \/api\/.env.bak HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/59.0.3071.125 Mobi\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env.bak",
        "evidence_snippet": "GET \/api\/.env.bak HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWebKi",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950521:leak-8",
        "950600:k8s-api",
        "http_backup_file_scan",
        "http_backup_path",
        "http_probe_api",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "c4a0fe09bc991f38f2762ac98ebb299ccaac5c38",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "79d69dbab75f7603ce6f8ff1846eda4ce95a3fd2",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 184,
    "payload_entropy": 5.210019321035018,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "4be193376d92e2a2935b279eda363f72e98830f6",
    "event_fingerprint": "c1a04d4bfd1415d01fe74bf4756287821bcc937d",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9d8a676a5e70446588dc3ff902297c42",
        "payload_hash": "553ad9ba9f3156ac4069c6902d0ba7cc",
        "path_pattern_hash": "ea63ee477c90ac313ab228a937b8deee"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)\r\nAccept-Char",
    "method": "GET",
    "path": "\/v2\/.env",
    "user_agent": "iTunes\/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)",
    "waf_tags": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/v2\/.env HTTP\/1.1",
    "request_sample": "GET \/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)\r\nAccept-Char",
    "evidence": {
        "method": "GET",
        "path": "\/v2\/.env",
        "user_agent": "iTunes\/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)",
        "waf_tags": [
            "950316:lfi-14",
            "950326:rce-0",
            "950468:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/v2\/.env HTTP\/1.1",
        "request_sample": "GET \/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)\r\nAccept-Char",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1c8653d9c6f13a99678e871ccc75765f0719bec1",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/v2\/.env",
        "request_line": "GET \/v2\/.env HTTP\/1.1",
        "http_user_agent": "iTunes\/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)\r\nAccept-Char",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/v2\/.env",
            "request_line": "GET \/v2\/.env HTTP\/1.1",
            "http_user_agent": "iTunes\/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/v2\/.env",
        "evidence_snippet": "GET \/v2\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: iTunes\/9.0.3 (Macintosh; U; Intel Mac OS X 10_6_2; en-ca)\r\nAccept-Char",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "txt",
    "http_ua_hash": "a08a6691c000b6d09a84aa33119be995e7aa0b73",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "43063baf0fda73950dd575fa216e503f70ad04be",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 220,
    "payload_entropy": 5.281294423699621,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 60,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 60,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 47,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "33f56cf6a54fcad8c112e45f7dedaacd90364ef2",
    "event_fingerprint": "055c3746faf5310923f3ffe03968873ff7e0ef7b",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
    "confidence": 0.6,
    "classification_confidence": 0.6,
    "precision_score": 62,
    "precision_signals": [
        "INT-beh-scan-burst"
    ],
    "kb_rule_ids": [
        "INT-beh-scan-burst"
    ],
    "confidence_breakdown": {
        "waf": 60,
        "classification": 64,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 47,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 52,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "add4c165fc98953f3593d97bcd03db7d",
        "payload_hash": "f6e3551a8ccb39724190d8ef2970f900",
        "path_pattern_hash": "4ff48f74005d677acf48e527b71c7273"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 47
    },
    "payload_preview": "GET \/env.txt HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; rv:45.9) Gecko\/20100101 Goanna\/3.2 Firef",
    "method": "GET",
    "path": "\/env.txt",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; rv:45.9) Gecko\/20100101 Goanna\/3.2 Firefox\/45.9 PaleMoon\/27.4.0",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3"
    ],
    "request_line": "GET \/env.txt HTTP\/1.1",
    "request_sample": "GET \/env.txt HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; rv:45.9) Gecko\/20100101 Goanna\/3.2 Firefox\/45.9 PaleMoon\/27.4.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/env.txt HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; rv:45.9) Gecko\/20100101 Goanna\/3.2 Firef",
    "evidence": {
        "method": "GET",
        "path": "\/env.txt",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; rv:45.9) Gecko\/20100101 Goanna\/3.2 Firefox\/45.9 PaleMoon\/27.4.0",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3"
        ],
        "request_line": "GET \/env.txt HTTP\/1.1",
        "request_sample": "GET \/env.txt HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; rv:45.9) Gecko\/20100101 Goanna\/3.2 Firefox\/45.9 PaleMoon\/27.4.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/env.txt HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; rv:45.9) Gecko\/20100101 Goanna\/3.2 Firef",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bb010e3e4c21486a2ff222205658fd71d98a11dc",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/env.txt",
        "request_line": "GET \/env.txt HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; rv:45.9) Gecko\/20100101 Goanna\/3.2 Firefox\/45.9 PaleMoon\/27.4.0",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/env.txt HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; rv:45.9) Gecko\/20100101 Goanna\/3.2 Firef",
    "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 \/env.txt",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 52%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 60 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 60,
            "classification": 64,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 47,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 47,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-beh-scan-burst"
        ],
        "tags_summary_labels_fr": [
            "Beh Scan Burst"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/env.txt",
            "request_line": "GET \/env.txt HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; rv:45.9) Gecko\/20100101 Goanna\/3.2 Firefox\/45.9 PaleMoon\/27.4.0",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 \/env.txt",
        "evidence_snippet": "GET \/env.txt HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; rv:45.9) Gecko\/20100101 Goanna\/3.2 Firef",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 52 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "env",
    "http_ua_hash": "ce0665e919ab2431d5107b7a688a9ec7343ef714",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "bd51d82ebe68616089e33c9b7e8bd3dca93e4339",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 251,
    "payload_entropy": 5.401668780410158,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 70,
    "tag_count": 11,
    "anomaly_count": 0,
    "campaign_key": "c41c5ac483f215c69cbdd9ba457f751d45b7623d",
    "event_fingerprint": "9808f077bfc6f13f143c8db5c87e8132f1c8e034",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 185,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0214"
    ],
    "matched_pattern_names": [
        "Probe \/api\/v3\/"
    ],
    "pattern_ids": [
        "pat-0214"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 70,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "7961387b3b4cf2093580f0400c7c63ad",
        "payload_hash": "7b3c425497d2523f8a3dc55f8a44cda2",
        "path_pattern_hash": "04909e92bace7d0131f14c363849c629"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 70
    },
    "payload_preview": "GET \/api\/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; moto x4) AppleWebKit\/537.36 (KHTML,",
    "method": "GET",
    "path": "\/api\/v3\/.env",
    "user_agent": "Mozilla\/5.0 (Linux; Android 9; moto x4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
    "waf_tags": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "nosqli-3",
        "leak-1",
        "k8s-api"
    ],
    "request_line": "GET \/api\/v3\/.env HTTP\/1.1",
    "request_sample": "GET \/api\/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; moto x4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/api\/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; moto x4) AppleWebKit\/537.36 (KHTML,",
    "evidence": {
        "method": "GET",
        "path": "\/api\/v3\/.env",
        "user_agent": "Mozilla\/5.0 (Linux; Android 9; moto x4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
        "waf_tags": [
            "950316:lfi-14",
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "nosqli-3",
            "leak-1",
            "k8s-api"
        ],
        "request_line": "GET \/api\/v3\/.env HTTP\/1.1",
        "request_sample": "GET \/api\/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; moto x4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/api\/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; moto x4) AppleWebKit\/537.36 (KHTML,",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "50d8e3f831fe1a9d4af2d4885732ffa365066d4f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/api\/v3\/.env",
        "request_line": "GET \/api\/v3\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; moto x4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/api\/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; moto x4) AppleWebKit\/537.36 (KHTML,",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/v3\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 70,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 70,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/api\/v3\/.env",
            "request_line": "GET \/api\/v3\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; moto x4) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/76.0.3809.111 Mobile Safari\/537.36",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/v3\/.env",
        "evidence_snippet": "GET \/api\/v3\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; moto x4) AppleWebKit\/537.36 (KHTML,",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api",
        "http_api_route_probe",
        "http_backup_file_scan",
        "http_probe_api",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "prod",
    "http_ua_hash": "a2f5be1d5ac6aa10c7fcbe2d1c77c5db6baaebac",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "a0523bde74b7800a5f62604ba67d5973949853e7",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 265,
    "payload_entropy": 5.370866837756122,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 70,
    "tag_count": 9,
    "anomaly_count": 0,
    "campaign_key": "f5997616fa1b2dc4cb2105f70d00b1c19e014e5c",
    "event_fingerprint": "a3848b593b1f7f59170fdd303921a0017748195f",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 70,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "52577325d8209d32a15419419ae7447e",
        "payload_hash": "779f302c98d859d67df70682d137cd0f",
        "path_pattern_hash": "0d46dff1e6403d12ac8e9a297c932ed9"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 70
    },
    "payload_preview": "GET \/api\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPad; U; CPU iPad OS 5_0_1 like Mac OS X; en-us) Ap",
    "method": "GET",
    "path": "\/api\/.env.prod",
    "user_agent": "Mozilla\/5.0 (iPad; U; CPU iPad OS 5_0_1 like Mac OS X; en-us) AppleWebKit\/535.1+ (KHTML like Gecko) Version\/7.2.0.0 Safari\/6533.18.5",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1",
        "k8s-api"
    ],
    "request_line": "GET \/api\/.env.prod HTTP\/1.1",
    "request_sample": "GET \/api\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPad; U; CPU iPad OS 5_0_1 like Mac OS X; en-us) AppleWebKit\/535.1+ (KHTML like Gecko) Version\/7.2.0.0 Safari\/6533.18.5\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: ",
    "payload_snippet": "GET \/api\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPad; U; CPU iPad OS 5_0_1 like Mac OS X; en-us) Ap",
    "evidence": {
        "method": "GET",
        "path": "\/api\/.env.prod",
        "user_agent": "Mozilla\/5.0 (iPad; U; CPU iPad OS 5_0_1 like Mac OS X; en-us) AppleWebKit\/535.1+ (KHTML like Gecko) Version\/7.2.0.0 Safari\/6533.18.5",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1",
            "k8s-api"
        ],
        "request_line": "GET \/api\/.env.prod HTTP\/1.1",
        "request_sample": "GET \/api\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPad; U; CPU iPad OS 5_0_1 like Mac OS X; en-us) AppleWebKit\/535.1+ (KHTML like Gecko) Version\/7.2.0.0 Safari\/6533.18.5\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: ",
        "payload_snippet": "GET \/api\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPad; U; CPU iPad OS 5_0_1 like Mac OS X; en-us) Ap",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ab1d4a55f327507c98c8b94e4dbe9d75462a99b6",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/api\/.env.prod",
        "request_line": "GET \/api\/.env.prod HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPad; U; CPU iPad OS 5_0_1 like Mac OS X; en-us) AppleWebKit\/535.1+ (KHTML like Gecko) Version\/7.2.0.0 Saf\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/api\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPad; U; CPU iPad OS 5_0_1 like Mac OS X; en-us) Ap",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env.prod",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 70,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 70,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/api\/.env.prod",
            "request_line": "GET \/api\/.env.prod HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPad; U; CPU iPad OS 5_0_1 like Mac OS X; en-us) AppleWebKit\/535.1+ (KHTML like Gecko) Version\/7.2.0.0 Saf\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env.prod",
        "evidence_snippet": "GET \/api\/.env.prod HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPad; U; CPU iPad OS 5_0_1 like Mac OS X; en-us) Ap",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api",
        "http_backup_file_scan",
        "http_probe_api",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "dev",
    "http_ua_hash": "f05d3fd3fb7a990477354dcd377f7195ee8d9db8",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "df0da649347f6e8b30ebfd6075798e279a79356e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 268,
    "payload_entropy": 5.381405844423946,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 70,
    "tag_count": 9,
    "anomaly_count": 0,
    "campaign_key": "f5997616fa1b2dc4cb2105f70d00b1c19e014e5c",
    "event_fingerprint": "9b4020381e4ff08a90691aae5e07ef01b70297c8",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 70,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "502070804244518f2fda1dc54aa32ea4",
        "payload_hash": "053b282b45082c2ad24524c34d827829",
        "path_pattern_hash": "a65c42973e65ed0c7793c8c71a0195da"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 70
    },
    "payload_preview": "GET \/api\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_2 like Mac OS X) AppleWeb",
    "method": "GET",
    "path": "\/api\/.env.dev",
    "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_2 like Mac OS X) AppleWebKit\/604.4.7 (KHTML, like Gecko) Version\/11.0 Mobile\/15C202 Safari\/604.1",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1",
        "k8s-api"
    ],
    "request_line": "GET \/api\/.env.dev HTTP\/1.1",
    "request_sample": "GET \/api\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_2 like Mac OS X) AppleWebKit\/604.4.7 (KHTML, like Gecko) Version\/11.0 Mobile\/15C202 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnectio",
    "payload_snippet": "GET \/api\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_2 like Mac OS X) AppleWeb",
    "evidence": {
        "method": "GET",
        "path": "\/api\/.env.dev",
        "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_2 like Mac OS X) AppleWebKit\/604.4.7 (KHTML, like Gecko) Version\/11.0 Mobile\/15C202 Safari\/604.1",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1",
            "k8s-api"
        ],
        "request_line": "GET \/api\/.env.dev HTTP\/1.1",
        "request_sample": "GET \/api\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_2 like Mac OS X) AppleWebKit\/604.4.7 (KHTML, like Gecko) Version\/11.0 Mobile\/15C202 Safari\/604.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnectio",
        "payload_snippet": "GET \/api\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_2 like Mac OS X) AppleWeb",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7bd14db6702ec4c5db099d4d8a1de915a64e748f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/api\/.env.dev",
        "request_line": "GET \/api\/.env.dev HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_2 like Mac OS X) AppleWebKit\/604.4.7 (KHTML, like Gecko) Version\/11.0 Mobile\/15\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/api\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_2 like Mac OS X) AppleWeb",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env.dev",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 70,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 70,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/api\/.env.dev",
            "request_line": "GET \/api\/.env.dev HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_2 like Mac OS X) AppleWebKit\/604.4.7 (KHTML, like Gecko) Version\/11.0 Mobile\/15\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env.dev",
        "evidence_snippet": "GET \/api\/.env.dev HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 11_2_2 like Mac OS X) AppleWeb",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api",
        "http_backup_file_scan",
        "http_probe_api",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "env",
    "http_ua_hash": "382da75523c223dfbcdd0e09421bce57344e47f9",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "510d89ba7f87ce49d7697f92088f4049153aa93e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 256,
    "payload_entropy": 5.450549423421849,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 70,
    "tag_count": 12,
    "anomaly_count": 0,
    "campaign_key": "0294b478f671b96b81356fc09ae88d74a5bba0ad",
    "event_fingerprint": "3ec90d201f62a924a7795d9a74ab0afb167b90c4",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 185,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0212"
    ],
    "matched_pattern_names": [
        "Probe \/api\/v1\/"
    ],
    "pattern_ids": [
        "pat-0212"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 70,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6bbabc1122a148f3bcd19efa6fcb88b6",
        "payload_hash": "d022d72e1a66c7251dcc6707cae8db02",
        "path_pattern_hash": "5df89d300eb37d420581ac8576ea9498"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 70
    },
    "payload_preview": "GET \/api\/v1\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
    "method": "GET",
    "path": "\/api\/v1\/.env",
    "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396.73172",
    "waf_tags": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "nosqli-3",
        "leak-1",
        "k8s-api"
    ],
    "request_line": "GET \/api\/v1\/.env HTTP\/1.1",
    "request_sample": "GET \/api\/v1\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396.73172\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/api\/v1\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
    "evidence": {
        "method": "GET",
        "path": "\/api\/v1\/.env",
        "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396.73172",
        "waf_tags": [
            "950316:lfi-14",
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "nosqli-3",
            "leak-1",
            "k8s-api"
        ],
        "request_line": "GET \/api\/v1\/.env HTTP\/1.1",
        "request_sample": "GET \/api\/v1\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396.73172\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/api\/v1\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0d540c4cefc781039789a364aeb55ebaa8097e9c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/api\/v1\/.env",
        "request_line": "GET \/api\/v1\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396\u2026",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/api\/v1\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/v1\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 70,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 70,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/api\/v1\/.env",
            "request_line": "GET \/api\/v1\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/33.0.1750.166 Safari\/537.36 OPR\/20.0.1396\u2026",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/v1\/.env",
        "evidence_snippet": "GET \/api\/v1\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api",
        "http_api_route_probe",
        "http_backup_file_scan",
        "http_k8s_probe",
        "http_probe_api",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "env",
    "http_ua_hash": "333795b1ffd81d4f7d9e17e6524803550e858c7f",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "368a782b06d2e3f08e91fcad6aa099df587b3caa",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 250,
    "payload_entropy": 5.409997237526943,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "78222e64ad50e78467413bbc46b7fb125471217a",
    "event_fingerprint": "8bc480b38a57f6d270aa6877ed087658a3cb100f",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 69,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "8a1caf5d28698d00af6bb5c5b5933eca",
        "payload_hash": "d2caf42eb48b628e6b9aeaafbf013470",
        "path_pattern_hash": "5ac5643a22156fcbe040fcd2350884e7"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 69
    },
    "payload_preview": "GET \/development\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 ",
    "method": "GET",
    "path": "\/development\/.env",
    "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/55.0.2883.87 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1"
    ],
    "request_line": "GET \/development\/.env HTTP\/1.1",
    "request_sample": "GET \/development\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/55.0.2883.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/development\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
    "evidence": {
        "method": "GET",
        "path": "\/development\/.env",
        "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/55.0.2883.87 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1"
        ],
        "request_line": "GET \/development\/.env HTTP\/1.1",
        "request_sample": "GET \/development\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/55.0.2883.87 Safari\/537.36\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/development\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "407a5e957ad7430471e2c138c49287fc2d6338db",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/development\/.env",
        "request_line": "GET \/development\/.env HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/55.0.2883.87 Safari\/537.36",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/development\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/development\/.env",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 69,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 69,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/development\/.env",
            "request_line": "GET \/development\/.env HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/55.0.2883.87 Safari\/537.36",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/development\/.env",
        "evidence_snippet": "GET \/development\/.env HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "http_backup_file_scan",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "staging",
    "http_ua_hash": "c78f02322c99a17d9bf3c3a8937d3ce147d6c27f",
    "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
    "http_target_hash": "558189df00dd1f382a665a69aadcd9f4c6685109",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 210,
    "payload_entropy": 5.286759475868319,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "ID",
    "dst_port": 8081,
    "risk_waf": 100,
    "risk_classification": 74,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 70,
    "tag_count": 9,
    "anomaly_count": 0,
    "campaign_key": "f5997616fa1b2dc4cb2105f70d00b1c19e014e5c",
    "event_fingerprint": "9799366d434f7dd3a1d5384bc05d0237892f2763",
    "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 215,
    "precision_signals": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "kb_rule_ids": [
        "SIGMA-web-config-leak",
        "INT-http_sensitive",
        "INT-upstream",
        "INT-waf-score"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 74,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 70,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "classification_parent": "backup_file_scan",
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "ID",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "7f1f327b116d556b944dbf004f33d945",
        "payload_hash": "7205ffa51a467cc36c964f87376a65f2",
        "path_pattern_hash": "07bb9306fa50af07f9ffa6d9d05639e6"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 70
    },
    "payload_preview": "GET \/api\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko\/20100101 ",
    "method": "GET",
    "path": "\/api\/.env.staging",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko\/20100101 Firefox\/7.0.1",
    "waf_tags": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "leak-1",
        "k8s-api"
    ],
    "request_line": "GET \/api\/.env.staging HTTP\/1.1",
    "request_sample": "GET \/api\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko\/20100101 Firefox\/7.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/api\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko\/20100101",
    "evidence": {
        "method": "GET",
        "path": "\/api\/.env.staging",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko\/20100101 Firefox\/7.0.1",
        "waf_tags": [
            "950326:rce-0",
            "950468:nosqli-3",
            "950470:nosqli-3",
            "950514:leak-1",
            "950600:k8s-api"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "leak-1",
            "k8s-api"
        ],
        "request_line": "GET \/api\/.env.staging HTTP\/1.1",
        "request_sample": "GET \/api\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko\/20100101 Firefox\/7.0.1\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/api\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko\/20100101",
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre_techniques": [
        "T1083"
    ],
    "mitre": "T1083",
    "threat_family": [
        "path_traversal",
        "config_leak_scan"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8e7c85902027b3bc6bed4325d2e35c542266f2a2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/api\/.env.staging",
        "request_line": "GET \/api\/.env.staging HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko\/20100101 Firefox\/7.0.1",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/api\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko\/20100101",
    "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env.staging",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 70\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 74,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 70,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 70,
        "risk_label": "\u00c9lev\u00e9",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": [
            "SIGMA-web-config-leak",
            "INT-http_sensitive",
            "INT-upstream",
            "INT-waf-score"
        ],
        "tags_summary_labels_fr": [
            "SIGMA-web-config-leak",
            "Http Sensitive",
            "Upstream",
            "Waf Score"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1083",
        "mitre_technique": "T1083",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/api\/.env.staging",
            "request_line": "GET \/api\/.env.staging HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko\/20100101 Firefox\/7.0.1",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/.env.staging",
        "evidence_snippet": "GET \/api\/.env.staging HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko\/20100101",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8081"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "matched_patterns": [],
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950514:leak-1",
        "950600:k8s-api",
        "http_backup_file_scan",
        "http_probe_api",
        "http_sensitive_path",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}