34.50.8.126

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "yml",
    "http_ua_hash": "6bdc83be1502cceec28399be1549bf9ea96387d9",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "3ec364769fb4698cfcca7031daf28214f8708060",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 296,
    "payload_entropy": 5.438495576298651,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 59,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "066377df37ab34ce32dcfed2cda4c6bee2c479d8",
    "event_fingerprint": "941f409adb5ae16a59b1aa7668f96fc165c7941c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "607b163a5ea2eb38609e341d7820bca4",
        "payload_hash": "35fd97f09e783463b723748de7eba737",
        "path_pattern_hash": "0bac82c8c4461b7e2eb48cd6eaefa7e9"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.github\/workflows\/ci.yml HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.",
    "event_signature": "aeba078f9d2e8fc34b609e63668772a748ab2357",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "f15ad93a757d3fdce0c7cdc38860e8111c4a08b0",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "6196821c9b59b6ceb2d7ccd4d35e939ea59e7ed4",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 408,
    "payload_entropy": 5.5650407451986705,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 88,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 88,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 63,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e2158ff06a25052ef7f76c0619498a1adf89ba1",
    "event_fingerprint": "d69a0f72e95a449c171dbce0d813a901d65c1492",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "5b4a616bd7fb9c7fa3410347ce5ef3b3",
        "payload_hash": "3fa12c89cc3b142acc0e8de47448b73d",
        "path_pattern_hash": "0d4eaf992f1a72b02518b7d952191a55"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/Jenkinsfile HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 6.0; NCE-AL00 Build\/HUAWEINCE-AL00; wv",
    "event_signature": "e605900efd447addc508e8fbf2d91f79e49663e2",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950086:sqli-21",
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "5979e42896be0a00cdda9c3893bea072472c8557",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "2dde7c7ac3e6a210a636b7b4438f90ddd70a6f86",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 273,
    "payload_entropy": 5.446954612903767,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2a097569c728d6e07e1cbdca821f319e91fbc558",
    "event_fingerprint": "8301f3c3cd03cf834fad370405e029c91e7e1127",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a7a02094a5bd5231e0367da4a21fce18",
        "payload_hash": "9c16eced9a3c83b194d326c8cb764489",
        "path_pattern_hash": "375bdd2accbc560de2cef140cdb7ad08"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.drone.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, li",
    "event_signature": "82373ecfc91742a154fba8b0c17c803781ee1b54",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yml",
    "http_ua_hash": "d2252eb771e4eec88081691e9a7fe02000ef5b62",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "1954ac9283af903ae4a6de319bd93df245fb035e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 185,
    "payload_entropy": 5.205042550110559,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 56,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 56,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 47,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "43102d34477351db43dc9ae95ce72b70b710d41b",
    "event_fingerprint": "9990f87cd1df2959a845f46009427124944687d9",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "4944e79cd760319f0194b0c3c7e7e440",
        "payload_hash": "3e2663ff63535a50cafbd13f54872c57",
        "path_pattern_hash": "f74d63edd884e7a9299ad52f54b46b61"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.drone.yml HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Avant Browser\/1.2.789rel1 (http:\/\/www.avantbrowser.com)\r\nAccept-Cha",
    "event_signature": "329c59c054af079c8e0657fd5a7233f562f2d509",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950406:ssrf-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yml",
    "http_ua_hash": "3598a33c0d9812b9a6a09efb124bb36d60116ac5",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "e18939aa25137b140957dface586fa6d87f55246",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 200,
    "payload_entropy": 5.244616427124155,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 32,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "051fa8b35bf94126ff8706dac9f47c688f313917",
    "event_fingerprint": "1382b7aa63db152d5259a4eea687799b2f2057d2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a9ca589850362022cd130c305f52518b",
        "payload_hash": "72492994821a55d3b2e9cb55693794be",
        "path_pattern_hash": "7196cda3d0ac0fc416539ef0a94d0999"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.71,
    "classification_confidence": 0.71,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/bitbucket-pipelines.yml HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Opera\/9.80 (Windows NT 6.0) Presto\/2.12.388 Version\/12",
    "event_signature": "a49d0fd8471cdf48241fc023bd943ffc5e1bddcb",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "debb15a7d68aa336bc36ec7e628a2911a37d6393",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "171840fe47dfd6f2d76e0b80f11136ea038cbc5d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 264,
    "payload_entropy": 5.396976159881385,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "9bfe078acc954cfc6320d8f8f2d54de2b7123a5f",
    "event_fingerprint": "276775f45d45d0f4dc6d15f5159efd84155ea2b5",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d60e0586986b6a343b0c6e2f32127712",
        "payload_hash": "73110bd4f8302a64be5711a2edac1884",
        "path_pattern_hash": "40125f4f361452a7111c9b4a9dc1dfb2"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/jenkins\/Jenkinsfile HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; Moto G (4)) AppleWebKit\/5",
    "event_signature": "5dd6a9fde631e7a54811bec51fa32cc8214938ff",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_jenkins",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "46875b8f9d1f66c6d3963868074ca4a9df7b9234",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "4bafbac6a6a3a3e498ce6febcc708140823e7542",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 252,
    "payload_entropy": 5.407452247722027,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 59,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "066377df37ab34ce32dcfed2cda4c6bee2c479d8",
    "event_fingerprint": "29c9ae944c8c0ead0357d43b26dc1736f1f9fad9",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "452d5022736dc61d00442d3c02cba1b4",
        "payload_hash": "3cfe1cbb4f1a6be6df06a3c415b9ffee",
        "path_pattern_hash": "483e00e02486581ed9691d00f40bae15"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.buildkite\/pipeline.yml HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.3",
    "event_signature": "7b410a604608fe351782570b7726b177497056dd",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "07bd06acffb0f13e2afd9b82c6c0846f995d6bb4",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "77d9f648329aebdef206c4b1d63546db6147ce3b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 163,
    "payload_entropy": 5.2759577565554014,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 36,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 36,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 34,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "874d42d4790ce780338f71175f63f06ae17b4458",
    "event_fingerprint": "656f35ef992eac22bc01ce55c8e34022d265d877",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "738e137eadfbfa8172a94e8d7c271831",
        "payload_hash": "6182dce2916b31983ceec0ef098c85db",
        "path_pattern_hash": "55839acef8bcadd99e7e1a1cdf75a15f"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/debug.log HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: DoCoMo\/2.0 SH901iC(c100;TB;W24H12)\r\nAccept-Charset: utf-8\r\nAccept-En",
    "event_signature": "12b775a332383d1c3022a0a1ea4111a4fb5b0ae8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yml",
    "http_ua_hash": "4a0435d4480da23db5d7a4effa1e42aa3271e477",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "8bacf7ba189e1d49695131e01ec30c1752198ab0",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 246,
    "payload_entropy": 5.4854139673465125,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 92,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 92,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 64,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "75d8a936350a678d137fbc0ea52d4f0e1c877b2d",
    "event_fingerprint": "5f19311fb4b49871e51ecaa303a64304ad050b99",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "8f9b3da601a7c969c40d85033bad0228",
        "payload_hash": "46c8966c7bf19e16d4aaeb1d5a43ad47",
        "path_pattern_hash": "d76578f2ff8c409283f48927713c6e3e"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/azure-pipelines.yml HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: POLARIS\/6.01(BREW 3.1.5;U;en-us;LG;LX265;POLARIS\/6.01\/WAP;",
    "event_signature": "57ef6643afe775b17a3827c8a37b46c1799beac6",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "2e20960c529b768663ec7c550297360efa8d5738",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "4bf2a42fc3c47a9cd3c9f83a2dcc96b460ea695c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 220,
    "payload_entropy": 5.228460022798004,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2a097569c728d6e07e1cbdca821f319e91fbc558",
    "event_fingerprint": "88c2501b4ad8e29419576020d95374a9025ea8c8",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "759954acf94d7cce7cdffe9b476cec8e",
        "payload_hash": "bf404e5834ccf22eacacc6385fe17a1d",
        "path_pattern_hash": "377fe372f5c11075aea15748100afc0d"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/error.log HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686 on x86_64; rv:2.0.1) Gecko\/20100101 Fir",
    "event_signature": "5e2500d1cce424d974a64e71ff94e43ef376cd52",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "736dbc96c3f0384fd7bd354348194b7b22bb56f2",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "194ffa296bf5bf546445bc77a4914a3c16983759",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 256,
    "payload_entropy": 5.403944650859393,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2a097569c728d6e07e1cbdca821f319e91fbc558",
    "event_fingerprint": "0cee1aa3f45ef653675d802cca782bfabcd7cb2f",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "0daa46420d56cf1cff3cb81566c44cdd",
        "payload_hash": "8858488b557349242a876abe20922734",
        "path_pattern_hash": "162fef3d3c20397fd9e19a55bcddfa03"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/application.log HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-M305F) AppleWebKit\/537.36 (K",
    "event_signature": "b0f4da1b7ea8b6b36c3ec7e8dca727439208e62e",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "4b34faf3bb1b579874fe2a9de9ae1f9c2939f5e1",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "63438c908367e4f8041717ab279c4d967e15af99",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 235,
    "payload_entropy": 5.412131264340386,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2a097569c728d6e07e1cbdca821f319e91fbc558",
    "event_fingerprint": "e37ba9e2e500e1e947ec4ba394a80cd535cadfa3",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "fdb80025e99489fe497e7387349cd0a4",
        "payload_hash": "7a67b2235050981a5e655e0c2cee6c47",
        "path_pattern_hash": "3185fcf0045ab357f9b5c65f6fd9ad4d"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/access.log HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gec",
    "event_signature": "e9397003d3221136be5ac815057f2b69adcc18cb",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "920f225acb78de641b569f0aae229581f1c7b1ba",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "5dd8c8bb33603d1ad2c91357a5bdf5e4a77e2fda",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 259,
    "payload_entropy": 5.375332316106046,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2a097569c728d6e07e1cbdca821f319e91fbc558",
    "event_fingerprint": "24f0ad2fb3b82ef3fa674e7ee0f2c02ee6d29d55",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "55689293c215be64cfa61eaa16984084",
        "payload_hash": "0e5e53b93913416aed3c707f0debd557",
        "path_pattern_hash": "e42ca631e5a6c090d1fddca82a4d1723"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/laravel.log HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; Lenovo K33a42) AppleWebKit\/537.36",
    "event_signature": "c0ffe11bdb7e6356e7950de4370bfc04b3aa4295",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "30f64055157dc1523c27299ce23be3c06ab177dd",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "bd1d5b79d00a082701f913befabe9ce3bb41a839",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.270762707749973,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2a097569c728d6e07e1cbdca821f319e91fbc558",
    "event_fingerprint": "5a4737c2c2c982abcc022c293e2831f79a0f0878",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "1321ad0a029ffe243cfb2e0f8f41e310",
        "payload_hash": "f53643edaf6235c7ce6da80349abf519",
        "path_pattern_hash": "705676047b0602f87a6c259c895bc0e9"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app.log HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:6.0) Gecko\/20100101 Firefox\/6.0\r\nAcce",
    "event_signature": "d70470e0e0fa43439f260950d07fa27a9248031b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "76ff783680576a1dc958ea9996ad72db21812594",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "437770240dcc724c5033b3c158c576b84dde4de1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 250,
    "payload_entropy": 5.3999786603455195,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2a097569c728d6e07e1cbdca821f319e91fbc558",
    "event_fingerprint": "38e45120d1ea3eb1335a0429406b1d4682eaed73",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "3c2f054fc27afb01bb69d65560415f8a",
        "payload_hash": "5f1ee397c82c8349c5e015bfdc79d0b2",
        "path_pattern_hash": "1bb66c038c973622f0056a763496f9ef"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/server.log HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/537.36 ",
    "event_signature": "40c5df55988b63d73364e07f7a4a42f4a5110f74",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "6aff732470fe58bd4790fe0369b32e207e465d2c",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "0306f640cbfe7832e364cfa8aaa4495e8ef14f08",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 253,
    "payload_entropy": 5.406981380168298,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2a097569c728d6e07e1cbdca821f319e91fbc558",
    "event_fingerprint": "e3e07c245a8f2616148ae0bc1a60fb2fd8a06607",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d2969e11d9e76c7da7c32972b11502fc",
        "payload_hash": "3b1ad688fd52a5203a1396ff41fafe61",
        "path_pattern_hash": "f8d80e9ce78cc8d6e0404ba95f5bd5a6"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/trace.log HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; SM-G930V) AppleWebKit\/537.36 (KHT",
    "event_signature": "cd15a1f1c7814c06fd630874e4bfb13663f5cee1",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "log",
    "http_ua_hash": "368e9b09924cd3b25e24999e07a8f79b5c3e4c95",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "03e204e4d1092f0f3982669317d2eb101a33266b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 286,
    "payload_entropy": 5.420391623022854,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "f719a1801e8e65c73e7ac527a719f4f265e4a111",
    "event_fingerprint": "d5d2e9915383bec505785c43d42fc1cef90c9026",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "48bf808ecb4530fe694b7fc7e0e9730a",
        "payload_hash": "53873675407047b5e7e53e16b760192e",
        "path_pattern_hash": "2521db54cde5bdc17cc591777e55b15e"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/logs\/debug.log HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML,",
    "event_signature": "77391636bf650000c6472d7af8a5a6dd4c135293",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_logs",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "log",
    "http_ua_hash": "8a024694601c0e166d78d0b1acb58b0f7664a3f6",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "d0b8b644029ba159087a417f2e8eafdc14fc0ddb",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 245,
    "payload_entropy": 5.394925001973469,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "d9cd48e50ad2b29880c7f9ba6636061cfbeedf7f",
    "event_fingerprint": "0c35a1929f7c9516fcbaffcccf8fbfb763dfb069",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "61315af453ed9b27630ab4c628a3ac9d",
        "payload_hash": "d599ebeb8b0ccd8c633ee457d78734a9",
        "path_pattern_hash": "1ee40b92eb3b65f75911cb662d7e1127"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/logs\/app.log HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHT",
    "event_signature": "5949d0b594d3d22c495869cf553911d89865130e",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_logs",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "htpasswd",
    "http_ua_hash": "c74843f1ffb15fa9e1bff2c7ebb8476eb2e00af3",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "ade2de8d21551efb00f221b43821b4acb26b6f79",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 192,
    "payload_entropy": 5.239468761284263,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 92,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 92,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 65,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "1076b73f5c26b399d7c887764956aace313aab32",
    "event_fingerprint": "c7fff535fc0744e313a447446710f21fc363e435",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9ef67134000797ca47327b1b4f9cabfd",
        "payload_hash": "033390cf3af3829fb5ecd4ffac4d551d",
        "path_pattern_hash": "229c0a4c773f5f9eeec1d298c58088ee"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.htpasswd HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Opera\/9.80 (X11; Linux i686; U; en) Presto\/2.2.15 Version\/10.10\r\nAcc",
    "event_signature": "9d729fdfae4e869840dc9cd3141b8fedb6159ab3",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950522:leak-9",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.878530675974343,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "ba198eb15d353e697a1c53b852c695b8",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003_\ufffd\ufffdt\u0019\u06d2P\ufffd\ufffdA\u0013\\\ufffdw\ufffd\u0011\ufffd\ufffd0\ufffd\ufffd\ufffduw\ud9cc\ude12?\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0775\u0015\ufffd5\ufffdO\ufffdE\u001d\ufffd\ufffd#\uf745h7\ufffd\ufffd\ufffd\ufffd\u001b=\u0013\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "a5d45e920d3cd991d52adee7e42b3ea8c5e555cf",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "py",
    "http_ua_hash": "0bdbb149ec39d8a2b1d57644cc3f034b6247b09a",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "d5789d665736cfa0ddfe8b823927e941f800dee5",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 257,
    "payload_entropy": 5.404409328210616,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 59,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "066377df37ab34ce32dcfed2cda4c6bee2c479d8",
    "event_fingerprint": "9c2d59082c077f10fe2a4960f781b6bb7a4c80e9",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "3dd18e85755478c5f78dc394453ab847",
        "payload_hash": "9581e9ae9da8c8f4214d2367567d6aad",
        "path_pattern_hash": "618ceab0c9dfa4ac1499dac941778116"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/src\/settings.py HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Pixel 3 XL) AppleWebKit\/537.36 ",
    "event_signature": "3d83c29fb069e132302d45e196ccc41aa6da8a36",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8134724387044585,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "8fe7994fcfcbf63e66b7a8239bc286b7",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0005~Z\f\ufffd*fR|a.Z \ufffd\ufffd\ufffd\ufffd\ufffdy\ufffdUT+\ufffdZ\ufffd\bI\ufffd\u0590K \ufffd\ufffd\ufffd\ufffd\ufffd1A),\ufffd\ufffdS\u0015\ufffd2>\u0004tKli\ufffd\u0000\ufffdVw\/\/\ufffd\ufffd\f\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "d21fcf6a45cbde1e5b7142bd45de59a3c65cd90a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.81929350080004,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "304da556c6030ee9c706e1a241c4620e",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdP\u00168\ufffd\u079e+\ufffd\u0019N\ufffdO\ufffdQd\ufffd\ufffd\u0013#\ufffd)t\ufffdsZ\ufffd;J\ufffd \ufffd\ufffdBi\r\ufffd\ufffdS\ufffd\ufffd\ufffd=c\ufffd\ufffd0fh\ufffd\ufffdu_,\u0010\ufffd\u0017\ufffd}\ufffd\ufffd}&\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "50b02799ca325c0c7b5df0568a6f69bc91328d6a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.859336574765168,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "9793ee271eaae8d6f652894cce29829c",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001fK\ufffd\u0205\ufffdy^s\u0007.~\"L\ufffd\u05b3M0\ufffd$\ufffdO\ufffd\u0446\ufffdc\ufffd\ufffd\ufffd \ufffd\ufffd\u00160\ufffd6\ufffdpg\ufffd\u001e\ufffd\ufffd,\ufffdt\u001f#\ufffd\ufffd\u0006\ufffd\ufffdN\ufffd\ufffd.\ufffd\ufffd3\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "a12779b39143727136676119f8d96af9b5da710a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8959321243871265,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "3799ee1dfad56e89762e43308c423525",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd4\u0014SaH\ufffdJ\ufffd\/EL\u000eu\ufffdW=\ufffd\ufffd\u0019\ufffd\u0014\ufffd\u04df\ufffdY\ufffd\f\ufffd\ufffd *>U\u0015l\u0001\ufffde\ufffd\u000e3\ufffd{w\ufffd]\ufffd\ufffd\u0018\ufffd\u001f\ufffdp7\ufffd\ufffd\ufffd\ufffdI\ufffd\u06c2\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "938a47bfc26ccf9843050217760727f330c77af2",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.863438875984192,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "98c4fbb70fadbe92492e477107cf8733",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\f\ufffda\u0014\ufffdlP\ufffd3a3\ufffd^V\u0018\u0007\ufffd~\u0012s\ufffdIdP\ufffdOZc\u000b \ufffd\ufffd\ufffd\f\ufffdM~\u001e\ufffd=.\ufffd\ufffd.\ufffd\ufffdp\ufffd\ufffd]u>3g\ufffd\u0007\ufffd\ufffd2\ufffd\ufffdn\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "e97b8bcebacc8880b035986f833eb9654bb6b4ec",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.832423772172437,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "90f19ee2a364d8cc2b948321d6c224da",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003{\u0017DvEF\ufffdd\ufffd\u000ez\u001fj\ufffd\ufffd3*,\u001f\ufffd\u0013\ufffdd\ufffd\u0649h\ufffd\ufffdL#z \ufffd\ufffd\ufffd\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd~\ufffd\ufffdY\u0018\ufffd\ufffd\"3H\ufffd\u000fQ\ufffd4\u00027\u001a5\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "286fddf065bc75128ca705ad311e18cfd31ffd81",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.813171578753854,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "3f7054cda6e91e5f9b936f7caa854205",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u001b\ufffd\u0014|\ufffdf\ufffd\ufffdK\ufffd\ufffd;\ufffd=\ufffdE7\ufffd\ufffd[\ufffd\u001b\ufffd\ufffd]\ufffdU|\ufffd \ufffd\ufffd\ufffds,\u0017\u0003\u0745h\ufffdB\ufffdsc\ufffd\ufffd[\ufffd\ufffd<y\ufffd\ufffd\ufffd\ufffd\u02c3\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "ac8003e728a31f73de5fbb14c643efe5b05d2882",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.875345363923094,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "5f576b0c805ad9d88bdcb5224705cf76",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003X'\u000b\ufffdV\ufffd\"U\u0017A\ufffd\ufffd \ufffdW\r-=\n5\/+b\ufffdB`\ufffd\ufffd8\ufffd\ufffd {\ufffd\ufffd]h\ufffd\u0000\ufffd\ufffd\"\\\ufffd\ufffdJ\ufffd\ufffdA\ufffd\ufffdE\ufffdO\u0640Y\u0002\ufffdi\u065eB\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "0d8d06b8cd969698d0acea7af07e8b390eb59c87",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.821755760394263,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "f8d90e7eabc0e993724fbe2a4ebb89c7",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0003\ufffdd\ufffd\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffd7\u0013\ufffd\ufffd?\ufffd5\u0000\u0004\ufffd\ufffdw\u001b\ufffd\ufffdQg\\\n 6\ufffd\ufffd\ufffd\u03b8v\ufffd\ufffd\u0480|\u0549\ufffd\ufffd\ufffdS(R\ufffdb\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\u0114\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "35f8cae680002b75b3a04bf893f03bea32fae8eb",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "7944810a277cef2fcc91d29d2f5ba78f79d1a684",
    "http_host_hash": "ca23b5d84feb2280b2be7602d1fc165f90b06f00",
    "http_target_hash": "0f33889264fd7e5079be0db185ae77168b0f8827",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 249,
    "payload_entropy": 5.439593747114553,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 59,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "066377df37ab34ce32dcfed2cda4c6bee2c479d8",
    "event_fingerprint": "c732b433e32c2d790dbab0baf6163ab01d54bc44",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a2a8e4949cec8208d1c45cc08349aa9f",
        "payload_hash": "0c6a2584c4317cf439128995328f7195",
        "path_pattern_hash": "c3151a920c5c3a0812f27a16fca80c98"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/src\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (",
    "event_signature": "328fcd3094c5610ba1582b5ab2dd8cd263017916",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.7212126868161235,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "802269908afd1028ed037907bb66d8c2",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdK\ufffd\ufffd\ufffd\u0016G\ufffd\u0011\ufffd\u001d@\u0000\ufffd&\ufffd\ufffd\ufffd;\ufffd\u001a\ufffd\ufffd\u06cd\ufffd\ufffd\ufffdiM\ufffd\ufffd c=\ufffd\ufffdj\u0003\u0015}X)\ufffdw\ufffdG\ufffd\n\ufffd\u0001\ufffd\ufffd\n\ufffdwCm\ufffdx0|>\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "0b8ee615c0a7e38213740657e5f82ddf01e4d10a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.843582457766992,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "84081865622ae8deddc29087272fb0da",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0018\fX\ufffd:\ufffd\u000b='\ufffd\u001b\ufffd=\u0018\ufffd\ufffd\ufffd\ufffd\u072b\ufffd}\ufffd\ufffdy\u0005\ufffdMLLb \ufffd#G\ufffd\ufffd0\ufffd)\u0015\ufffd\ufffdb\b\ufffd\u0010\u0003k\u00194\ufffd\ufffd\u000eb\ufffd\u0015\ufffd\ufffd\ufffdh\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "2282ff65cb6e05d6fedd8e010b9d8eb6e6643fe6",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.7950761294250395,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "77552fdf4fae3625fd8f15376aab89f7",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001+\n\ufffdO]Q\ufffd\ufffdR\ufffd` \n\ufffd\u001bn\ufffd7[\u0002cb\ufffd\ufffd\u0000\ufffd\ufffdr\ufffd\ufffd\ufffd \ufffd\u0001\u0011\ufffd'Nt\ufffd0\ufffd-\ufffd4K:\ufffdI~\ufffdW\ufffd5\u0014=^\ufffd\ufffd\ufffdr\ufffd\ufffdn\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "179736ac689f1e609d64d204e61dfaf8ce4d541c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.847205624016089,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "bac1b14b3bbd63105eb79c2b2f3403cf",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001aM1\u0004$v\ufffd\ufffd\u0012\ufffd\ufffd#\/%\ufffd\ufffd\ufffd\u0546\u0018\u0004\ufffdM\u065b\ufffd\ufffd\ufffd\ufffd?}) \u000eV\ufffd`\u000eHG\ufffd\ufffd\ufffd\u0016g\ufffd\u0015B\u0015&\ufffdJ-\ufffdQE\u0015\u0019u\ufffd\ufffd.*h<\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "8e3a56f155caf7b043f5b6728880e30b2f76862e",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.7512037123964035,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "1e7fc2808183e2e47a9b59a1e667f3f3",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdS\ufffd1\ufffdt\ufffdi\ufffdE\ufffd\ufffd]\u0018\ufffdA\ufffd\ufffd\u000b\ufffd$\ufffd\ufffd\ufffd\"%\u0003\ufffd\u0005\u0005\ufffd \ufffd3{\ufffds\ufffd\ufffd+\ufffd\ufffd\n\ufffdf\ufffd\ufffd\f\u0006\ufffd\u0012;\ufffd(\ufffd\ufffd\ufffd\ufffd\u00175\ufffdQ\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "9c7d64d234ccc0d9923d8da09919583260de35e4",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.835114460545421,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "4b3adb2d1221fa10811d41caad7aeecf",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdat\ufffdF2\ufffdU!n\ufffdp\ufffd\ufffdu\u0000M6y\ufffd\u0007 \ufffd\ufffd\ufffd*S\ufffd)\ufffd.\\ \ufffd\ufffd\u0012^\ufffd\ufffd\ufffdG\ufffdZ\u022b\ufffd\ufffd\ufffd6\ufffd{u{W~.\ufffd\ufffdoT\ufffd\u05776\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "7a96ac16146e07984fbfe11700dd0efc78b84123",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.843804331161245,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "a890a856b63411024d47bd2d309311bc",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\"\ufffdd\ufffd\ufffd\u02a0\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(M\ufffd\u001e\ufffdW\ufffd\u0015;3\u0386F\ufffdL\ufffd) \ufffd\u0002\ufffd\\d\ufffd\ufffde{<Q4\u0019\ufffd\n\ufffd\u073dk\ufffd6A\ufffd\ufffdtN\ufffd\ufffd97^\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "b4e65d50f2c728260886c4951386ee056d3832e2",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.883787145677678,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "a2ed7eed0609f345966869d6c9ca63c0",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd31\ufffdW\ufffd-\ufffd.\ufffd\n\ufffd&h\ufffd\ufffd\ufffd\ufffd\u04e5\ufffd\ufffd]\u00144\u0017\ufffd\ufffd$\ufffd \u0018a\ufffd\u0012\ufffdmMC\ufffdZ\ufffd\ufffd\u058b\u0013Y\ufffd.\ufffdw\ufffd{Ro\ufffd\ufffd\ufffdu\ufffdH\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "7165ce31f89bcd947ed4e9813493a9f060c7da01",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.87538344908994,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "62beeff8b488fc505ef0690000391298",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\b\ufffdIG\ufffd\u000eM\ufffd\ufffd\ufffd7\ufffd\ufffdv\ufffd\u0160\ufffd8:\ufffdKw\ufffd\ufffd\ufffd\t\ufffd\ufffd8\u000e \ufffd\ufffd\u044c\ufffd\ufffd\ufffd\ufffdo`,\ufffdp\ufffdx\ufffdE\ufffd\ufffd\ufffd\ufffd\u05f6$cs\u0603\u07aa\ufffdg\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "1dc4c752353fa3956a00270c3ac6977d6856254b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.854594735782683,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "54d2aa5437dbde3a942aad8d628ec48c",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003l\ufffd\u001a\ufffd\u0016b\ufffd\ufffd\u0017\ufffd\ufffd\ufffdN\u0012^\t\ufffd\/\ufffd\ufffd\ufffd\u0014\ufffd\u0003&C\ufffda\ufffd\ufffd\u0004 %4\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdaXm\u0017\ufffda\ufffd\ufffd\ufffd\ufffd\ufffdz-\ufffd\ufffd\ufffd\u07db\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "db524a35097cd9465192acea710ba097df14b5a1",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.84472344387083,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "72dd172738fcd2516b4989cd9e28a636",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdw\ufffd\ufffd\ufffd\ufffdn\ufffdN\u0014-G\t\ufffd\u04f6,!\ufffd\u0017g\f|s\u0011L\u0013\ufffd\u0015D8 -\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u0007<mo#G[R\ufffd\ufffd\ufffdu\ufffd\ufffd\ufffds\u0276\ufffd\u0001\ufffd\ufffd\"\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "e60de7e7dd5a4cbb2b06484ec5c259f37ca51ccb",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.823038214312492,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "ec4347481c0a25941401cf847e4442bc",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003O\ufffd\u0014M\n\ufffd\ufffd]`\u001c\ufffd\ufffd\u000bI{_\u0018U\ufffd\ufffdl\ufffd\ufffd\"P\ufffdL\u001b\ufffdfW\u0012 \ufffd\u0015\ufffd\ufffdo\u0151%x\ufffd\u0012\ufffd\"\u0011\ufffdX\u0750\ufffd\ufffd\ufffd\ufffd\ufffd:j4|\ufffd\ufffd0\b\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "081719394614f194e7cd7cadd384f412dfb02b3c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.824698304704324,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "d27326731761c702c923ef40c41040f6",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003y?$,\u0004\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd\ufffd0=\"\u0017\u0006_\ufffdP'Fh\ufffd\u0248\ufffd\ufffd\ufffd:T Y8H\ufffdG^\ufffdS\ufffd\u042f\ufffd\u046e\"\ufffd\ufffdm\ufffd\ufffdW\ufffd\ufffdc\ufffd.\u001cL\ufffdR\u000f3\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "b9e3c5a80b500d577814f24b9549bb6f6fb36852",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.7202539905838865,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "186687f93b437d1f0bae4bd6c4df4f88",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd+\ufffd2\n..\ufffdx\ufffd$\u0001\ufffd\u0019j\ufffd\ufffd\ufffd!k\ufffde\ufffd\t\ufffd|\u0004\u0011q)\ufffd \ufffd\ufffdR\ufffd\u001bF.\ufffd\u0001CKD\ufffd&\u04ed\u001cY\ufffd\ufffd\u0005\ufffdP\ufffd.\ufffd\ufffd\ufffdb\ufffd\ufffd\u0013\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "3fbd93070465ab0487526713eb45a6d24a696ab4",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.848663848056242,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "bbb092a33477d75034c7f5b7b09cfe91",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003R_k~\u0002\ufffd\u001f\ufffd\ufffd?w\ufffd\ufffdY\nCd\ufffdK\ufffd\u0014\ufffd\bB\ufffd]\u0014\u0011\ufffd+\ufffdE w\ufffd(\ufffd\u001c\ufffd\ufffd%c`\t3\ufffdVJJ@\u06a3X3#\ufffd\b3D\ufffd\u0005\u0563\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "4a425497620d1a767d09bec88e0485088b02015a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.857218426536393,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "8e3ed3d1fda8e36e7648c7bc23327dc0",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u02ab\ufffd`\ufffdg\ufffd\ufffd\ufffd\t?\ufffdX\u0010I\u001b\u0000\ufffdIf\u000e\ufffd,\\\ufffd-\ufffd\ufffd \ufffdlG>MI\f\u0002!kG\ufffd\ufffdN\ufffd\ufffd'\ufffd\ufffd\u0743\ufffd\ufffd\ufffd+\u731f8\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "c6538d353f88e89aaffa26a3266eefb81b935565",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.794584703494735,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "88d4bb37789e1d15f57c599881c7bd5b",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003)\u0000hz\ufffd\ufffd\"\ufffd\u000e\ufffdx\ufffd^\ufffd\u0011G\ufffd\u0000\ufffd\u05a9\u0003\u00023\ufffd\u0005\ufffdd\ufffd\ufffd\u0437 \ufffd.%\u0708}\ufffd\ufffd\ufffd+\ufffd\ufffd1l\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffdB+\ufffd\u0480X^\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "62bddfef9dd3387b70f0189fda6545506009c17c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.86492601247676,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "65b90979880ba1c204b5a2a235e4c223",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003=(\ufffdz\ufffd\u0002\ufffd~\ufffd\ufffdu\ufffd\u0014o\ufffdLY1\u001c9\ufffd\ufffd\ufffd6\ufffdbj\ufffd\ufffdJi .7\ufffd\u0013\ufffd\ufffd\u0365\ufffd\u0012\ufffd\ufffd\ufffd,&\ufffd\ufffd\u0015\u0710\ufffdy\ufffd\u0000\ufffd\ufffd\ufffd\u001e\ufffdh\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "6482ef488d696ad336daca26027fee5bed8635d9",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.837118817174765,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e44e1afa404f83525fcece8ca32605625bfc6ee",
    "event_fingerprint": "da805481df9317bb8a7ba95a89c2d3d657418f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "6af88d4ca7ed422bc216ae9fa65b4d3b",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003>\u0012KWA\ufffd\b\u001d\ufffdJV\t\ufffdr\ufffd\ufffd\ufffd?\ufffd\ufffdq.\u0006\ufffd\ufffd\ufffd\u00f5\ufffd<'\ufffd \ufffd\ufffd\u07b5\ufffdI5\ufffd'\ufffd\ufffd~6\ufffdO\ufffde\ufffd|\u0010\ufffd\ufffd\u0000\u001a@\ufffd\ufffd\u0010H\ufffd.\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "da686a421d36163f7ed5aad0defcb4b70cb301b2",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}