34.72.176.129

{
    "tls_ja3_hash": "3b2bd66322b37fde2a4c604fc5b3bdcd",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 2,
    "tls_alpn": [
        "h2",
        "http\/1.1"
    ],
    "bytes_in": 1765,
    "payload_entropy": 7.774977057351711,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 5064,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "971082e069b3eb4dade1a3bc00648283e73a51ca",
    "event_fingerprint": "c0586e7835ebfa9103d14b97bce73898467f51c9",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "tls",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "3b2bd66322b37fde2a4c604fc5b3bdcd",
        "payload_hash": "3dec7250a45680bfea0cedad93cd7dde",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 5064,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
    "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffd\ufffdm\ufffd\ufffd5\ufffd~\ufffdH[%i0\ufffd\nN;\u0011\ufffdb\ufffd\ufffdGr\ufffd+CO\u001cO#\u0000\u0412R\ufffd\ufffd\u000f\ufffds\ufffd\ufffd\b\ufffd@;\ufffd\ufffd&)u\ufffd-\"\ufffd\ufffd\ufffd\b\ufffd\u0002\u0018\ufffd\ufffdq\ufffdPN\ufffd\ufffd.\ufffd\u0000rMl\ufffd\ufffd\ufffd\u0132p\ufffdv\ufffdg\ufffdy\ufffd\t*\ufffd\ufffdk@\u0014hl\ufffd\ufffdnpU\ufffd\ufffd_\u001aP\ufffd\ufffd;P\u001ezfs\ufffd\ufffd\u0019\ufffd<l7t\ufffd",
    "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffd\ufffdm\ufffd\ufffd5\ufffd~\ufffdH[%i0\ufffd\nN;\u0011\ufffdb\ufffd\ufffdGr\ufffd+CO\u001cO#\u0000\u0412R\ufffd\ufffd\u000f\ufffds\ufffd\ufffd\b\ufffd@;\ufffd\ufffd&)u\ufffd-\"\ufffd\ufffd\ufffd\b\ufffd\u0002\u0018\ufffd\ufffdq\ufffdPN\ufffd\ufffd.\ufffd\u0000rMl\ufffd\ufffd\ufffd\u0132p\ufffdv\ufffdg\ufffdy\ufffd\t*\ufffd\ufffdk@\u0014hl\ufffd\ufffdnpU\ufffd\ufffd_\u001aP\ufffd\ufffd;P\u001ezfs\ufffd\ufffd\u0019\ufffd<l7t\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e939c053239537573ed8bdeec007bdfa64041959",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
        "tls_ja3": "3b2bd66322b37fde2a4c604fc5b3bdcd",
        "port": 5064,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd+\ufffdu\ufffdH\ufffdc%\ufffdO\ufffd\ufffdB\ufffd\u017d`\ufffd\n\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd+\ufffd\ufffd&\ufffd\ufffd\ufffdi\ufffddb\ufffd\ud8cc\udf84 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5s\ufffd\ufffd\ufffd\r\ufffd\ufffd",
    "attack_vector": "tls probe \u00b7 via TLS:5064 \u00b7 (sonde \/ probe)",
    "target_port_label": "5064 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 5064,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u0014\ufffdb\ufffd\ufffd+\ufffdu\u000f\ufffdH\ufffdc%\ufffdO\ufffd\u001f\ufffdB\ufffd\u017d\u001b`\ufffd\n\u000e\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd\u0011+\ufffd\ufffd&\ufffd\ufffd\ufffdi\u0013\ufffddb\ufffd\ud8cc\udf84\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd",
            "tls_ja3": "3b2bd66322b37fde2a4c604fc5b3bdcd",
            "port": 5064,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "tls probe \u00b7 via TLS:5064 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdb\ufffd\ufffd+\ufffdu\ufffdH\ufffdc%\ufffdO\ufffd\ufffdB\ufffd\u017d`\ufffd\n\ufffd< G\ufffd-\ufffdh\ufffd2\uac18\ufffd\ufffda\ufffd+\ufffd\ufffd&\ufffd\ufffd\ufffdi\ufffddb\ufffd\ud8cc\udf84 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5s\ufffd\ufffd\ufffd\r\ufffd\ufffd",
        "target_port_label": "5064 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "5064"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "6875a1bf76f6588692083c8648c8a881",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 2,
    "tls_alpn": [
        "h2",
        "http\/1.1"
    ],
    "bytes_in": 1797,
    "payload_entropy": 7.770475273694821,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 5069,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "b120e6ec3a3ccf152c018c0c2baae2dd8c90f482",
    "event_fingerprint": "451d5b5feea039ebba05ef83c7c590ede56b265b",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "6875a1bf76f6588692083c8648c8a881",
        "payload_hash": "f514743e58736456942b399aa2db4901",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 5069,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffd\u0015g\ufffdl}X\ufffd\u0013Mo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\u0003\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv\u0016|\u0016\ufffd\ufffd^\ufffd[\u000e~V\ufffd\ufffd@\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffd\u0015g\ufffdl}X\ufffd\u0013Mo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\u0003\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv\u0016|\u0016\ufffd\ufffd^\ufffd[\u000e~V\ufffd\ufffd@\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u001b\u0000\u0003\u0002\u0000\u0002\ufffd\u0001\u0000\u0001\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\ufffd\ufffd\u0000\u0001\u0000c\ufffd\u0004\ufffd\ufffd\u0013j\b\u0506\ufffd\ufffd\ufffdF\ufffd\ufffd\ufffd\u0006u\u0012\ufffdU\u000f)\u000e\ufffdH\ufffd$\u000f\ufffd\"H\ufffd\f\u0002J\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd<D\rT\ufffd\ufffd\ufffd\ufffd\u000e\ufffd\ufffdS\u0012\u0247\u001b\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffd\u0015g\ufffdl}X\ufffd\u0013Mo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\u0003\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv\u0016|\u0016\ufffd\ufffd^\ufffd[\u000e~V\ufffd\ufffd@\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b12421dba82e1ea544fdf659f937dc441a7418cb",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffd\u0015g\ufffdl}X\ufffd\u0013Mo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\u0003\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv\u0016|\u0016\ufffd\ufffd^\ufffd[\u000e~V\ufffd\ufffd@\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd",
        "tls_ja3": "6875a1bf76f6588692083c8648c8a881",
        "port": 5069,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffdg\ufffdl}X\ufffdMo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv|\ufffd\ufffd^\ufffd[~V\ufffd\ufffd@ jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\n\n\ufffd\ufffdc\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:5069 \u00b7 (sonde \/ probe)",
    "target_port_label": "5069 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 5069,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffd\u0015g\ufffdl}X\ufffd\u0013Mo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\u0003\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv\u0016|\u0016\ufffd\ufffd^\ufffd[\u000e~V\ufffd\ufffd@\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd\ufffd\ufffd\u0000\u0000\u0000\n\u0000\f\u0000\n\ufffd\ufffdc\ufffd",
            "tls_ja3": "6875a1bf76f6588692083c8648c8a881",
            "port": 5069,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:5069 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd_\ufffdh\ufffd~%%]\ufffd\ufffdf\ufffd\ufffdg\ufffdl}X\ufffdMo\ufffd?\ufffd\ufffdf\ufffd 9X\t\ufffd8\ufffd\ufffdQ\ufffd\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffdv|\ufffd\ufffd^\ufffd[~V\ufffd\ufffd@ jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\n\n\ufffd\ufffdc\ufffd",
        "target_port_label": "5069 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "5069"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Google LLC",
    "service": null,
    "app_proto": null,
    "asn": 396982,
    "country": "US",
    "dst_port": 5093,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1bbd7acf1bbbc8b779dc61786182fa026bbef483",
    "event_fingerprint": "a7c2aeba5c2161a393b6f81d935f0190c532b954",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 5093,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "82adc64d22eee6fcc15e7d1dd317e7d6f6831a87",
    "protocol_details": {
        "port": 5093
    },
    "attack_vector": "Sonde port \u00b7 port 5093 \u00b7 (sonde \/ probe)",
    "target_port_label": "5093",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 5093,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 5093
        },
        "attack_vector": "Sonde port \u00b7 port 5093 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "5093",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "5093"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "b7f5c2c88bfdeae8fe66203e320ba05c",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 2,
    "tls_alpn": [
        "h2",
        "http\/1.1"
    ],
    "bytes_in": 1765,
    "payload_entropy": 7.759354854756302,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 5081,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 5.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "20e7c9891938ecc742976665720f48e9cacce874",
    "event_fingerprint": "a572ee187c2bf5fb4bbc3e494dc2cf7469999bd0",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "tls",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "b7f5c2c88bfdeae8fe66203e320ba05c",
        "payload_hash": "b0f032173f1eef906ca5bc3d73460643",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 5081,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u000e\n\ufffd\ufffd\u001eE\ufffdNZ\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffd\bK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd\u00153\ufffdY\ufffd\u0017k\u0372\ufffdb\ufffd\ufffd\u0018\u0011\ufffd\u00033\u0011\ufffd7\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s**\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u000e\n\ufffd\ufffd\u001eE\ufffdNZ\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffd\bK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd\u00153\ufffdY\ufffd\u0017k\u0372\ufffdb\ufffd\ufffd\u0018\u0011\ufffd\u00033\u0011\ufffd7\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s**\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 ]\u032a\u0001,!\ufffdQ\ufffd\ufffd\ufffd\ufffd0J#\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\ufffdh\u0011\ufffdZio\ufffd\ufffdO3\u0000\ufffds\u0016V\ufffd\ufffd\u0011\ufffd\ufffd\ufffd_\ufffd\u0080\ufffd\ufffd\u0003+%\ufffd\u03bb\ufffd\ufffds=C\u00066\ufffd\u0016\u07bd\"\ufffd\ufffd-\u0000\u0011\ufffdl\u001c#\ufffd\u0003d\u0010@\"\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffdiB\ufffd\u026f\u0006\t\ufffd\u001f1\ufffd\ufffd3\ufffd\ufffd\n\ufffd\ufffd\ufffd~\ufffdr\u000e\ufffd\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u000e\n\ufffd\ufffd\u001eE\ufffdNZ\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffd\bK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd\u00153\ufffdY\ufffd\u0017k\u0372\ufffdb\ufffd\ufffd\u0018\u0011\ufffd\u00033\u0011\ufffd7\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s**\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000",
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0e37024c090d370a7b6a44636420c908c2fd3f7a",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u000e\n\ufffd\ufffd\u001eE\ufffdNZ\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffd\bK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd\u00153\ufffdY\ufffd\u0017k\u0372\ufffdb\ufffd\ufffd\u0018\u0011\ufffd\u00033\u0011\ufffd7\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s**\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000",
        "tls_ja3": "b7f5c2c88bfdeae8fe66203e320ba05c",
        "port": 5081,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\n\ufffd\ufffdE\ufffdNZ\ufffd\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffdK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd3\ufffdY\ufffdk\u0372\ufffdb\ufffd\ufffd\ufffd3\ufffd7\ufffd JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5s**#",
    "attack_vector": "tls probe \u00b7 via TLS:5081 \u00b7 (sonde \/ probe)",
    "target_port_label": "5081 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 5081,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\u000e\n\ufffd\ufffd\u001eE\ufffdNZ\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffd\bK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd\u00153\ufffdY\ufffd\u0017k\u0372\ufffdb\ufffd\ufffd\u0018\u0011\ufffd\u00033\u0011\ufffd7\ufffd\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s**\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000",
            "tls_ja3": "b7f5c2c88bfdeae8fe66203e320ba05c",
            "port": 5081,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "tls probe \u00b7 via TLS:5081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\n\ufffd\ufffdE\ufffdNZ\ufffd\ufffd\ufffd\ufffd\ufffd\u9810\u0719\ufffd!'\ufffdm\ufffdK\ufffd3\ufffd =\u0230\ufffd\ufffd\ufffd;\ufffd\ufffd3\ufffdY\ufffdk\u0372\ufffdb\ufffd\ufffd\ufffd3\ufffd7\ufffd JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5s**#",
        "target_port_label": "5081 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "5081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742075706e705f73736c20726561647920706f72743d353030320d0a",
    "emulator_response_len": 39,
    "bytes_in": 1797,
    "payload_entropy": 7.741912163785317,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "upnp-ssl",
    "app_proto": "upnp-ssl",
    "asn": 396982,
    "country": "US",
    "dst_port": 5002,
    "risk_waf": 8,
    "risk_classification": 24,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 24,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "635244ab8fe14803de4ee902481371fdc394b70a",
    "event_fingerprint": "78838bed4de0be42bda35b043c5f75aeb5745302",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0607"
    ],
    "classification_reason": "Type \u00ab upnp-ssl \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 24,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "upnp-ssl",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4b3ec9c3e38a7510714d944c2c8a407c",
        "path_pattern_hash": "28dfe76216994f641aeccc82eb9dae0e"
    },
    "target_context": {
        "dst_port": 5002,
        "service": "upnp-ssl",
        "service_name": "upnp-ssl",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003g\ufffd\ufffd\u0017Ro\ufffd2\ufffd\ufffd\ufffd&\u0010\u0000\ufffd+\ufffd\ufffd\u0005\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\u0005\\\ufffd|\ufffd\ufffdO\ufffd\u000e\t\ufffd\ufffd\ufffd7\ufffd\u0015\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003g\ufffd\ufffd\u0017Ro\ufffd2\ufffd\ufffd\ufffd&\u0010\u0000\ufffd+\ufffd\ufffd\u0005\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\u0005\\\ufffd|\ufffd\ufffdO\ufffd\u000e\t\ufffd\ufffd\ufffd7\ufffd\u0015\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u00003\u0004\ufffd\u0004\ufffdJJ\u0000\u0001\u0000c\ufffd\u0004\ufffd\u0532*\ufffd\ufffd\u01fb\u0657\n\u0002U0B\ufffdC\u0003?wN\ufffdR\u0007B\ufffd\ufffd\ufffdy\u04be\ufffd\u0007\ufffd\ufffd\ufffd\ufffd\ufffd]X,\ufffd\ufffdLRt)l\ufffde\ufffd\ufffdh`\ufffd2\u001c\ufffdh\ufffd\u0016\ufffd\u0019\ufffd\u00011Y\n\ufffd\u0005\ufffd\u0000\u070e\ufffdS\ufffd`3\ufffd\ufffd\u833e\ufffd\ufffdt\ufffd$K0:7!\ufffd\ufffd\u0674E\ufffd\ufffd\u0006\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003g\ufffd\ufffd\u0017Ro\ufffd2\ufffd\ufffd\ufffd&\u0010\u0000\ufffd+\ufffd\ufffd\u0005\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\u0005\\\ufffd|\ufffd\ufffdO\ufffd\u000e\t\ufffd\ufffd\ufffd7\ufffd\u0015\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000",
        "classification_reason": "Type \u00ab upnp-ssl \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7aa7e6349c297e9511bb3643e2bb3694be78777f",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003g\ufffd\ufffd\u0017Ro\ufffd2\ufffd\ufffd\ufffd&\u0010\u0000\ufffd+\ufffd\ufffd\u0005\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\u0005\\\ufffd|\ufffd\ufffdO\ufffd\u000e\t\ufffd\ufffd\ufffd7\ufffd\u0015\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000",
        "port": 5002,
        "service": "upnp-ssl",
        "service_label_fr": "UPNP SSL"
    },
    "evidence_snippet": "\ufffdg\ufffd\ufffdRo\ufffd2\ufffd\ufffd\ufffd&\ufffd+\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\\\ufffd|\ufffd\ufffdO\ufffd\t\ufffd\ufffd\ufffd7\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::",
    "attack_vector": "upnp-ssl \u00b7 via UPNP SSL:5002 \u00b7 (sonde \/ probe)",
    "target_port_label": "5002 \u00b7 UPNP SSL",
    "emulator_service": "upnp-ssl",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab upnp-ssl \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab upnp-ssl \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 24,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "upnp-ssl",
        "service_label_fr": "UPNP SSL",
        "dst_port": 5002,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0607"
        ],
        "tags_summary_labels_fr": [
            "pat-0607"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-upnp-ssl",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0007\u0000\u0001\u0000\u0006\ufffd\u0003\u0003g\ufffd\ufffd\u0017Ro\ufffd2\ufffd\ufffd\ufffd&\u0010\u0000\ufffd+\ufffd\ufffd\u0005\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\u0005\\\ufffd|\ufffd\ufffdO\ufffd\u000e\t\ufffd\ufffd\ufffd7\ufffd\u0015\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006\ufffd::\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000",
            "port": 5002,
            "service": "upnp-ssl",
            "service_label_fr": "UPNP SSL"
        },
        "attack_vector": "upnp-ssl \u00b7 via UPNP SSL:5002 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdg\ufffd\ufffdRo\ufffd2\ufffd\ufffd\ufffd&\ufffd+\ufffd\ufffd\ufffd\ufffd\\\ufffd\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdL:\ufffd,cZ7o'\ufffd\u02e7\t\ufffd\\\ufffd|\ufffd\ufffdO\ufffd\t\ufffd\ufffd\ufffd7\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::",
        "target_port_label": "5002 \u00b7 UPNP SSL",
        "emulator_service": "upnp-ssl",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "upnp_ssl",
        "service_banner": "honeypot-upnp-ssl",
        "service_os": "linux",
        "dst_port": "5002"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "9413b77bc24164873c4faf66ba0696cf",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 2,
    "tls_alpn": [
        "h2",
        "http\/1.1"
    ],
    "bytes_in": 1765,
    "payload_entropy": 7.744082224103206,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "US",
    "dst_port": 5116,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "f3bb33a61fe55d23ab72c5f2ac21cb1ab71bbfc0",
    "event_fingerprint": "69f2dcc975de227ea19473d02c3168c78716b505",
    "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
    "confidence": 0.47,
    "classification_confidence": 0.47,
    "precision_score": 56,
    "precision_signals": [
        "pat-0556"
    ],
    "kb_rule_ids": [
        "pat-0556"
    ],
    "matched_patterns": [
        "pat-0556",
        "pat-0607",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Kafka ApiVersions key",
        "Sybase TDS login",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0556",
        "pat-0607",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 32
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 47,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "9413b77bc24164873c4faf66ba0696cf",
        "payload_hash": "8362c678820de54c74e395f5f5fdfd2f",
        "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13"
    },
    "target_context": {
        "dst_port": 5116,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 32
    },
    "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003O\ufffdW\n\u0012#\ufffd\ufffd\ufffdpc\ufffd\ufffd{\"\u0007\ufffd\u0012\u001d\ufffd,\ufffdFOE\ufffd\ufffdH\ufffd\u001d \ufffd\ufffdR\ufffd\ufffd(\ufffdlA\n\n\ufffdv\ufffd\ufffd{\ufffd\b\ufffd\ufffd\ufffd\ufffdTX\n\u0001b\ufffdE\ufffd\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\u001a\u001a\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0012\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003O\ufffdW\n\u0012#\ufffd\ufffd\ufffdpc\ufffd\ufffd{\"\u0007\ufffd\u0012\u001d\ufffd,\ufffdFOE\ufffd\ufffdH\ufffd\u001d \ufffd\ufffdR\ufffd\ufffd(\ufffdlA\n\n\ufffdv\ufffd\ufffd{\ufffd\b\ufffd\ufffd\ufffd\ufffdTX\n\u0001b\ufffdE\ufffd\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\u001a\u001a\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0012\u0000\u0000\u0000#\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003Di\u0000\u0005\u0000\u0003\u0002h2\u0000-\u0000\u0002\u0001\u0001\u0000\n\u0000\f\u0000\nzzc\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u00003\u0004\ufffd\u0004\ufffdzz\u0000\u0001\u0000c\ufffd\u0004\ufffd\ufffd\ufffd\f\ufffd\ufffd\u0007\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u0016\u000fQ\ufffd\ufffdv\ufffd5",
        "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003O\ufffdW\n\u0012#\ufffd\ufffd\ufffdpc\ufffd\ufffd{\"\u0007\ufffd\u0012\u001d\ufffd,\ufffdFOE\ufffd\ufffdH\ufffd\u001d \ufffd\ufffdR\ufffd\ufffd(\ufffdlA\n\n\ufffdv\ufffd\ufffd{\ufffd\b\ufffd\ufffd\ufffd\ufffdTX\n\u0001b\ufffdE\ufffd\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\u001a\u001a\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0012\u0000",
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8af6002286d6b7807149820c6871d8a27c285ad3",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003O\ufffdW\n\u0012#\ufffd\ufffd\ufffdpc\ufffd\ufffd{\"\u0007\ufffd\u0012\u001d\ufffd,\ufffdFOE\ufffd\ufffdH\ufffd\u001d \ufffd\ufffdR\ufffd\ufffd(\ufffdlA\n\n\ufffdv\ufffd\ufffd{\ufffd\b\ufffd\ufffd\ufffd\ufffdTX\n\u0001b\ufffdE\ufffd\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\u001a\u001a\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0012\u0000",
        "tls_ja3": "9413b77bc24164873c4faf66ba0696cf",
        "port": 5116,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdO\ufffdW\n#\ufffd\ufffd\ufffdpc\ufffd\ufffd{\"\ufffd\ufffd,\ufffdFOE\ufffd\ufffdH\ufffd \ufffd\ufffdR\ufffd\ufffd(\ufffdlA\n\n\ufffdv\ufffd\ufffd{\ufffd\ufffd\ufffd\ufffd\ufffdTX\nb\ufffdE\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5s",
    "attack_vector": "kafka probe \u00b7 via TLS:5116 \u00b7 (sonde \/ probe)",
    "target_port_label": "5116 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100",
        "confidence_pct": 47,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 32
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 32,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 5116,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0556"
        ],
        "tags_summary_labels_fr": [
            "pat-0556"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003O\ufffdW\n\u0012#\ufffd\ufffd\ufffdpc\ufffd\ufffd{\"\u0007\ufffd\u0012\u001d\ufffd,\ufffdFOE\ufffd\ufffdH\ufffd\u001d \ufffd\ufffdR\ufffd\ufffd(\ufffdlA\n\n\ufffdv\ufffd\ufffd{\ufffd\b\ufffd\ufffd\ufffd\ufffdTX\n\u0001b\ufffdE\ufffd\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0006s\u001a\u001a\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0012\u0000",
            "tls_ja3": "9413b77bc24164873c4faf66ba0696cf",
            "port": 5116,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "kafka probe \u00b7 via TLS:5116 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdO\ufffdW\n#\ufffd\ufffd\ufffdpc\ufffd\ufffd{\"\ufffd\ufffd,\ufffdFOE\ufffd\ufffdH\ufffd \ufffd\ufffdR\ufffd\ufffd(\ufffdlA\n\n\ufffdv\ufffd\ufffd{\ufffd\ufffd\ufffd\ufffd\ufffdTX\nb\ufffdE\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5s",
        "target_port_label": "5116 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "5116"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}