34.80.146.76

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "json",
    "http_ua_hash": "10329f040aa4373e3487c1b258df14f6b63e7ca4",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "52ce12cd9608e2aaf265869963eb9ccc97689fda",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 257,
    "payload_entropy": 5.40024780134838,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c0f244479aa9cd802d5f39ccef48d7319a47eb61",
    "event_fingerprint": "8cb95920cbdf0e0483757c71f729874f7bbb7da4",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "77a075ab7cddd761ebe2dc4942da3c24",
        "payload_hash": "92848faca0c0f23fa867568bb44e3bfb",
        "path_pattern_hash": "2c897236c88b33a0e02927235471c8c3"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit\/5",
    "event_signature": "475a429e7e259a532734650b16fd574ce6ec1b50",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "json",
    "http_ua_hash": "647f16f55b66a212b4f2ada9a9e7640066037f7a",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "9906f032745691753325e07cb911e68c17846b5d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 249,
    "payload_entropy": 5.337376459017275,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b02007ed243d2c78b60b79f24de47f772bdf0919",
    "event_fingerprint": "2d4fd7bc7041c6187f2d9a35b9467c68845ed57c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "2205047ffd34297bdda6a9a525ace6e9",
        "payload_hash": "55ba6c8da1949ee9a0351d9a3b1f61c9",
        "path_pattern_hash": "1abd330c58113f23df400bb25a78bd81"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit\/605.1",
    "event_signature": "7de087aa514e3b0ebc417e38e2e69326d9116064",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "http_k8s_probe",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "f98a65e7aaa2a674609ce0e58c31530c28b5189b",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "1cd12d8c17a4fd004b4a7caca660c7ba1b5dd38e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 223,
    "payload_entropy": 5.297594149749757,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c0f244479aa9cd802d5f39ccef48d7319a47eb61",
    "event_fingerprint": "ae279bc1ab345863a5f7a7d9122d72005e12e18d",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "8fac6af1320ab85eee6a8c24e6cff7d0",
        "payload_hash": "77ac3c77283ee35f29b22119c21da126",
        "path_pattern_hash": "b8f00d48a004f38140a03a88e4b761f9"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/credentials.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_7_2; rv:10.0.1) Gec",
    "event_signature": "4aa5f17afc6fc828d0a5107f386c581c044daf78",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yml",
    "http_ua_hash": "7fb5a15f91400da514ff88cbecea66906d9c079e",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "e7274406f40c7a10480f2d85d43c70d3b9b7d566",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 255,
    "payload_entropy": 5.491467935020923,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b02007ed243d2c78b60b79f24de47f772bdf0919",
    "event_fingerprint": "56dd01b977c4cedbc9df073073765ff3d2218c7d",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "0d08f48cfa2464840f5c5b6289149669",
        "payload_hash": "fdb910ca479c40c4b9a23d25bff489a3",
        "path_pattern_hash": "246a47626a113b12058b21154a5a0dd6"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/secrets.yml HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; ASUS_X01BDA) AppleWebKit\/537.36 (KH",
    "event_signature": "d2d5d30ac8f4f3e0c58766924301a08482ec8efb",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "http_k8s_probe",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.818354001665302,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "60eec5b811e469ab33481ad9610889b9",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003i\u0001\ufffd\u000e]\ufffdO\ufffds$\r\ufffdd1\ufffd%s\ufffd\\\ufffd\ufffd)TN\ufffdTSj\t\ufffd[C n\u0014\ufffd\ufffd\ufffdJ\fq:\ufffd\u0013\ufffdeH\u000bn\ufffd\u010bT!\ufffd\ufffd\u0002\u0005\u0534\ufffdno\u001e\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "43754ceea54ab269025de8db6f5a77866ea9e00b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.814676596774172,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "70ee3203889e7e3ff118478b391a0372",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\n\ufffd\ufffd\ufffd\ufffdN\u0005\ufffd\ufffdP\ufffd\u04ba\u001b\u001e\ufffd\ufffdo\ufffd\u0016\u001a\ufffd\/\u0012\ufffd)A3k \ufffd\ufffd.\u0007a\ufffd,V\u001do\ufffd]\ufffdN\ufffd0\ufffd\ufffd(\ufffdk\u0011\u001cWe\r\u0016\u03c4\ufffd?t\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "884bc1cd403d320290a96a924ffa4f90793680be",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yaml",
    "http_ua_hash": "4e51c4a69d35f8603788d255250a49d3903c96e7",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "bed465ef7b10319d6adf1a5770456b92d16890b0",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 270,
    "payload_entropy": 5.435546888025645,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b02007ed243d2c78b60b79f24de47f772bdf0919",
    "event_fingerprint": "21c441b3ad1cde423e0807d4cf3646344dcbb6db",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "70e9695190b6387e401af7104a7b54ee",
        "payload_hash": "bb36cb6291832f96ba8570d78ea080d6",
        "path_pattern_hash": "48d0edff0af203e37d12a3776eddc53f"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/secrets.yaml HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit\/537.3",
    "event_signature": "cd773de9465da77639013e24fc0e2c1da735ea44",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "http_k8s_probe",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.846556307348884,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "14dde4bf89706e00ed174c439ee3f974",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001b\ufffd\ufffd\u01ec\ufffd\ufffdFKo\ufffd\ufffd1\ufffd\/1\ufffd\ufffd\ufffd\u033e\ufffd\u0007@\ufffd\u03c7\ufffd\ufffd\ufffd@ 4I{\ufffd\ufffd4qg\ufffd;MI\ufffdOy\ufffdrFx\ufffd\ufffd\ufffd\uf982C\ufffd\u001d\u0007DQ\u0013\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "fe6b5de846e3eac3bb45c37e60cc4d86aa795db1",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.829258197886167,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "565b555e56ea08710e683eb57aa5e2c7",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003g\ufffd\ufffd\ufffddxQ\ufffd3\"AL\ufffd\ufffd\ufffd\ufffd^p\ufffd\ufffd\ufffd\ufffdQa\ufffd\ufffd:\ufffdJ\ufffd\ufffd \ufffd\ufffdq\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffd<\r\ufffdS\ufffd!\ufffdiC\u0018\ufffd\ufffdV\u011d\ufffd7\ufffdn\ufffdd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "be0beafd88ef9a33a8153dd725f44307760ca5f4",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "env",
    "http_ua_hash": "d96a66ccbddcb09e6ce6a45f6dd8ef2e2962bbb6",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "22d014944096d18c7b20cd03c2d4364413794fe1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 286,
    "payload_entropy": 5.421385361859964,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b02007ed243d2c78b60b79f24de47f772bdf0919",
    "event_fingerprint": "4f7f874282f39ad610c6b3d8add0fba07cf3b145",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "dc765649ca628def36daa9e3b5bee2be",
        "payload_hash": "4fd1a8e37db2844569b78d3373361e50",
        "path_pattern_hash": "0883c67cadc74a16a43d777352b0b9da"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/secrets.env HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTM",
    "event_signature": "26d00d96f325effa08d79486f086e8cd74f36cbc",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "http_k8s_probe",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "json",
    "http_ua_hash": "a5130a500f12ad7c5e616cc08b17bfc1887bcb6c",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "cba94a1b37f4bc1c6667e76235119ed3064bd656",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 199,
    "payload_entropy": 5.311406467274838,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c0f244479aa9cd802d5f39ccef48d7319a47eb61",
    "event_fingerprint": "47a71939169b86a1650d2e36dfb5c53dc0d48088",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ab47230f2150f70c92dbdfbe86846fdf",
        "payload_hash": "d086e5f5c58dd477bacfa5136d4dee61",
        "path_pattern_hash": "45bc7fdb4d234c918d3617f96e56d2a9"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/private.json HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux; i686; en-US; rv:1.6) Gecko Debian\/1.6",
    "event_signature": "1ea8c89565361917b683c201fdc49e17fc0e1713",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8499690812190295,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "0fd377631679d945fd8f142b33bcf639",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00037\ufffd\ufffd\ufffd\ufffd'\/\ufffd?\ufffd\nj\ufffd`\ufffd\ufffd\u0338\ufffd\u001ar\ufffd\ufffd\u001c2^=R\ufffd\u050cV \ufffd\u000b\ufffd\u000e(?\ufffd\u02b7\u0216{+~@0v\u0007\ufffd\ufffd-x\u0002b\ufffd\\m\ufffd\ufffd\\\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "4b19c09c05896e628a49e9423950c00455a7ca3a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "json",
    "http_ua_hash": "06a1cbba5942e28e50a7dad516263e17584f28fa",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "c3ac892564a71141581a4e5efe8d4174457be60d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 257,
    "payload_entropy": 5.435080968785874,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c0f244479aa9cd802d5f39ccef48d7319a47eb61",
    "event_fingerprint": "ef8678b4e4fdd54f33466e7f3feb32fd022a4b09",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "386546da8088e26d6c0234e7f32b22e2",
        "payload_hash": "496c0f9e31cdb06b0dc068e05f70be6b",
        "path_pattern_hash": "ac1c8497c117520986c9f2f44ae6cfa7"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/keys.json HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML,",
    "event_signature": "57c4d9d6b6bd5f2c6051ecd1a77489c6e0b6df7b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "json",
    "http_ua_hash": "3d77c52f1a50d28ca0eebc94b9e6082edb129814",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "11f90d09ab2be62b71e86ff2300d82bf95914c93",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 233,
    "payload_entropy": 5.376990828663191,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 32,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3ed2702e722869828b7a86161427c6b53228e1b4",
    "event_fingerprint": "797de1ec4fe2565be6db0ef87f64544bdf70de34",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "9b51cfeafc425d088d905883838646b0",
        "payload_hash": "7b684c3780abe2493c2ea01c7255f61a",
        "path_pattern_hash": "b9a820ca8b2e17563e04a37bc3cb0c35"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.71,
    "classification_confidence": 0.71,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/secret.json HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko",
    "event_signature": "43073f6a1f6da1fab6e011133df429294c4d63b7",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.892266441128495,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "2ff23c76fff34c3c353498022524f308",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003A\u001e\ufffd}\ufffdQ\u000e\ufffd\ufffdj\ufffd\ufffd\ufffd\u0013\ufffd\u001d\ufffd<jSf\u0004\u001fdml\ufffd\ufffd\ufffd\ufffd \ufffdX\u001em\ufffd\ufffd\u022f\ufffd\ufffd\u000f\u0007\nx}|\ufffd%\ufffdE~\ufffd\ufffd\ufffd\ufffd[\u01839n\ufffd;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "2249468b56dcf872f632fafe5ef1e7961a397c53",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8028603091023445,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "a4922c23a56216be476d73629994d759",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u\ufffd\u037c&\ufffd\ufffd\"\ufffd;\ufffd\u0004V{\ufffd\ufffdgm\ufffdEf\ufffd\u0012\u000e\ufffd\ufffde<\ufffdf\ufffdW {\ufffd\ufffd\ufffdtr\u0012 \u000bR\udb44\udc04\ufffdw\rV\u0142\/\u01ae\ufffd\"y\ufffdX\ufffd9\u030c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "1b4cc777154204b0581b6dd42b86aaabd7543307",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.820025390286393,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "6e6e8d4a2899effa50c99c5c3ef18a8b",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t\ufffd\ufffd\ufffdk\ufffd\ufffdPO6\ufffdOZ\ufffd\ufffd\ufffd\no@A4\ufffd\ufffd\u066d9\ufffd\ufffd\u0018\u000b\u0012\u0001 \ufffd\u0006\ufffdL\ufffd\"@\rW\u0015\ufffd3;^b+jF\ufffd\ufffdX\ufffd\ufffdh\u000b~]T\u05e2\ufffdP\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "df9c9ece84dde830cd95d60e28e4f7474c4967b3",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "json",
    "http_ua_hash": "f8a238d8e07e035567a350f98653611abdb4c5aa",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "3971e7314acad350173b94aed96196fdfff8d535",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 209,
    "payload_entropy": 5.373742416267822,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c0f244479aa9cd802d5f39ccef48d7319a47eb61",
    "event_fingerprint": "6725138242c07fb35aaeafa7c22f8d3aef1225b3",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "04e170b80efa0d73e0e27727b0e87f21",
        "payload_hash": "e2f13fba9e0790ab7eaedce7bbb3469a",
        "path_pattern_hash": "6a6e9ce9657aeba0082f546e97e5badf"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api_keys.json HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:35.0) Gecko\/20100101 ",
    "event_signature": "2ee5950d26fef002bcfb8533a00c9107b82305f9",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "json",
    "http_ua_hash": "5ed7c912ed52acb29257c5860cda44c67e6f6bd2",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "c66ed2cb2ee7945e15913f0f7ca32c846f13537b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 216,
    "payload_entropy": 5.3289292984026355,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 36,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 36,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a078bcf386ad20b60bdbf36b322e2a50f9664e48",
    "event_fingerprint": "8bb838470754f9750532eb7ceec84144620307cd",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "084d7468348ca89606dd789f11043b60",
        "payload_hash": "79029f306f3802d745e43507e5dd9d6a",
        "path_pattern_hash": "015c5a8e5b64863b9df5b863319a5c2b"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api-keys.json HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 6.12; Mi",
    "event_signature": "07aad6f80c3c6777a0a9a7a16328d4433764b46c",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "http_metasploit_ua",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yml",
    "http_ua_hash": "8c2614bbf9f218a5d976ff58f743fe6b7c425646",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "b1b0ece8c60b688b45eb0e1d24e20b9eba285b7f",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 280,
    "payload_entropy": 5.499146694445368,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 60,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 60,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c0f244479aa9cd802d5f39ccef48d7319a47eb61",
    "event_fingerprint": "a26ddd9879c4f7c1084edbe6d977438e0fd1f973",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "01d2aa7a14467af5cbdbef13441abb73",
        "payload_hash": "0339fbddd716d01865cea1c4cd16083e",
        "path_pattern_hash": "5ca9a05c1d66736244e2d5f5eca525aa"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api_keys.yml HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.2; U; Series60\/3.1 Nokia6120c\/3.70; Prof",
    "event_signature": "c3ee6819874eb18ff9d82ea91c3c7d6a20e42b81",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.839012502593352,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "9eb11a60cda644cb8e685cd6b1adab60",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003#(\u0521@\ufffd6g!(6\ufffdt\ufffd\u001f\u001apge6\ufffd4\ufffd\ufffd\bu+\ufffd$*\u01ca [\ufffd\u0011j+\u00129\ufffd=\ufffdB\u03f8\ufffd+\u0016\u0019a)\ufffd\ufffdKY\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdF\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "4d8c4b40d99306b176f14df5c4aa1f79bcff53a8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.854538570518551,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "3c96f9426f98a491b600cb30afb29c9b",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\f+\ufffd\ufffdjF\u0015\ufffd\ufffd7W\ufffd-\ufffd\u001b\ufffd\u058b\f\ufffd\bz\u000e\n;\ufffd\ufffd\u0002\u04dbt \ufffd~\ufffd\ufffd\u0005\ufffdb\ufffd\u0001\ufffd\u000fS6$\ufffd\ufffd\ufffdCc\ufffd\ufffd\ufffd\ufffdT\ufffd\ufffdO\u0014\ufffd\ufffd\u022f\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "0d7b32caf03fa39e4b88a93f6d3bef681fa67d67",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "87b64c323bad4897f402b77cc04a4b8f6abb72fc",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "23a7fdebb2c6a62d7d99ec7e14a583ee335f985b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 267,
    "payload_entropy": 5.443870829068243,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "e9b29616ecdb0c18831bb7f222425f5604d1f0de",
    "event_fingerprint": "78df3ce4c463cca174fa4f76d2fba509fa2b2066",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "5511549ca0434329bc8d4e68e8aa15b4",
        "payload_hash": "c267b7c7e07e3265375405db7c2a26eb",
        "path_pattern_hash": "cccb8d748e9f900a4a8cbc953ef4ca7f"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 1,
    "classification_confidence": 1,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (",
    "event_signature": "9a32d97451073e5c74602ef377b3b68e7c0a95df",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.815112566074394,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "ae2bb6aa82f36d9f3170a5fc946b2c9b",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u02ed9\ufffd~\/\ufffd\u001fP\ufffd\ufffd\/\ufffd\ufffde\ufffd2\ufffd1\t\ufffd=,E;\ufffd`\u05e0\u01fbv \u04e5\/L\u059az\ufffd\ufffd9@A\ufffd\u001e\u0001\u0012\u001f\ufffd\\Y\ufffd\ufffd\ufffdn\u0019\ufffdd2X\ufffds\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "01e641dc4acc04d14b3e403dbfc3e452d2079b4a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.82967604504144,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "b342740b519486ea7961f7c51253e986",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003T\f\u0005i\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd5,\ufffd;\ufffd?\ufffd;\ufffd\ufffd\u0001U\ufffd\u001b\u0013\ufffd\u001b#\ufffd6\ufffd\r Q\ufffd'\ufffd\ufffd)\ufffd\ufffd~mL6\/\ufffd\ufffdoeg\ufffd\ufffd\u0010\t\ufffd\ufffd\ufffd7\u0014\ufffd\ufffdo\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "76ee8aa5b508d6acfb6b5accdeeb9ab81edbcc86",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "php",
    "http_ua_hash": "a178d1ad304a2c1c03f0710b15e57c19414c53ff",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "514e7d3a4a3b92e1be2515643df9985485409f7e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 215,
    "payload_entropy": 5.387260934868386,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "e9b29616ecdb0c18831bb7f222425f5604d1f0de",
    "event_fingerprint": "5a14cf60f3cea93471a703e21676551b389d3078",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "539f85876cba5fa19c49ef4b6d59c4fc",
        "payload_hash": "212a3f76604ab831b9bde72879a3cd70",
        "path_pattern_hash": "b207f8075f9179f23f0d3550b27348d0"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 1,
    "classification_confidence": 1,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (SymbianOS\/9.1; U; de) AppleWebKit\/413 (KHTML, like",
    "event_signature": "18d1f4c9410eba4ef35e5e46ccd1f90241941070",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "23a822de2ed816c92112ae57dc0233cb940b3215",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "4744e451f0e5837e40fea15eeae656c670359c61",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 207,
    "payload_entropy": 5.315300172009311,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "3049539215988761405038bd2258e14fde106d6a",
    "event_fingerprint": "bb21dd6cfb0f33890015eb86f91981374e75a796",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b5ce20ec335f9cec50b5780e9e056899",
        "payload_hash": "ee0c33a19977ac4cebf9afad9258cf6c",
        "path_pattern_hash": "1d6a542ea609410a54ba728eccda5c8b"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2; Win64; x64; rv:16.0) Gecko\/16.0 Fi",
    "event_signature": "dd822aa6e099f27a4a2fa8a89f1a4397978d7cf7",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "02d246b5f4271207748a027aecdb626e87bd9ccc",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "fbbc2fe6ffa673120e2143579206c207fd9a2f04",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 281,
    "payload_entropy": 5.430150934004307,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "3049539215988761405038bd2258e14fde106d6a",
    "event_fingerprint": "2287a5fe87dabd5d940583be8e0b022888bf0632",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d5dbaf6a0a14d80dcdd46eb5ddb1236a",
        "payload_hash": "3c508f11467ca057f869e6ea29164a2e",
        "path_pattern_hash": "603fa88b9ea2fe408c03592c8df3f75e"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit\/",
    "event_signature": "2aac3ddf811c6b73426d281cb80ee9f465f46042",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "61c975e289051418f310f4707a9a210f4f3d6612",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "ca1a81175cd9e58e9e1d76706220c73a85edea6c",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 253,
    "payload_entropy": 5.3553825593165785,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "3049539215988761405038bd2258e14fde106d6a",
    "event_fingerprint": "b4f1a6a04bde69b383ad7f8695523571db0262d4",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e2b5f30394d0648f3c813bde0e861966",
        "payload_hash": "4e63843cc2232193ab7f0a8c6e9c753e",
        "path_pattern_hash": "bf4cbe1c6a04f0ce19969bc5a096ab48"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/settings.yml HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit\/6",
    "event_signature": "b312cdf8f3888f1b12c6fd1dc6dcb53b92e239a1",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "0a0bcefa87413ca5dc0d5c25734336832c15bdf2",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "c7925f5b0f216247bb0a000827dd8b1a02615d1d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 201,
    "payload_entropy": 5.268586657222221,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 69,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "1a056cb6ed35b160d4e662e1b4ccdb3bffcb57ef",
    "event_fingerprint": "70a7dc8eb831e48a268935ce7589d1fb5b62a82d",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "5921f6b1c7926384d75f8f881a2569ee",
        "payload_hash": "8f38b3c5e6a668fe71631b70ce26da25",
        "path_pattern_hash": "a85c0cffdce7f3cd5f8342a635486f8c"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 1,
    "classification_confidence": 1,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (compatible; YandexNews\/4.0; +http:\/\/yandex.com\/b",
    "event_signature": "08f98c7062cecbfa96dcd7c885b93a1dd1edc8de",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8145587996244394,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "53df9cfc2f4fb9221a01e5cd479eb02b",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003W\u000e<D\ufffd\b\ufffd2\t7\ufffd\ufffd\ufffd\ufffd{\u07a5~\ufffd\ufffd\u000e\ufffd\u0015:\ufffd\ufffdN\ufffd1\ufffd\ufffd E\ufffd-S\ufffd\ufffd\ufffd\ufffd~*\ufffd\ufffdkL\u0000\ufffd\ufffdwo\ufffd\ufffdU\ufffd\f\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u0000\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "f56fc1b736bd7bb9edd1afc2675625d356bc89f6",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.844615544862068,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "001ebbe3af3fec26190e621f28299d6c",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003r\ufffdin\ufffd\ufffdC\ufffd\ufffd{w\u0019C\ufffdNg\ufffd\ufffd\u0006\ufffdZ~\ufffde\u0002\u001ci\ufffd\ufffd\ufffd\ufffd \"\ufffd\ufffd\ufffd\ufffd7\ufffdow\ufffd\ufffd\ufffdd\ufffd\u0004\ufffd\ufffd\u02db\ufffd\ufffd\u0006\"N\ufffd$\u06be\ufffdz\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "49d73774cb9cdfe35e04b835aa00f3e17d0960f3",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.740299982049654,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "367ebc60b9d968b7be3007180d11f48e",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001dQx\ufffd\ufffd=i\nG\ufffdG -u~\ufffd\ufffd\ufffdK\u000b\ufffdm\ufffdS\ufffdK\ufffd\ufffd\ufffd\u0003 \ufffdm\ufffd\u0012\ufffd\ufffdK\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffdx\ufffd\ufffdY0\ufffd\ufffd\ufffd)\ufffd\ufffdT,\ufffdmv+\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "972645f7e66a00fc7d16d4f0a56f4c9ac7024fb2",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.834993619773369,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "f85bbc13ea92699b53aea4727f5806ba",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003^\ufffd\ufffdM\r\ufffd\u001f\u00055\ufffdI\ufffdU\ufffd$)M\u0001\ufffd\ufffd\ufffdT]\ufffd\ufffd\ufffd\ufffd\b\ufffd\ufffdk\ufffd \ufffdQs\ufffd*\u0018\ufffd:_\ufffdv[S\ufffdIAs*o\ufffd\u0007#pW\u0017*m@\ufffd\ufffd\"\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "f8c50a939dbc5722b644a513566c2d83b6a7e7ef",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "php",
    "http_ua_hash": "81acb39d44f0a266ab1ef577349890d507edb650",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "3b0f704debd9557578c7b95595853680ba57e853",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 256,
    "payload_entropy": 5.3880674296646145,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "3049539215988761405038bd2258e14fde106d6a",
    "event_fingerprint": "7313e0a3d81af319eba5d8f4ed71de36502fd42c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "1779dfe6f34faf53f6e1200f3da51e00",
        "payload_hash": "e470db529213faecf338263f67b35fbb",
        "path_pattern_hash": "0e4dd4a2248d9ed0c82f50221193673a"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1; A1601) AppleWebKit\/537.36 (K",
    "event_signature": "2acb263172d3a9be5648d38c01d1f58827dd5548",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.776845542086207,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "6a6a1fa0a90661c62497cb295a279d9a",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003`\u0000\u000b\u0007\u000f\ufffd\u0014El\ufffdD\ufffd\u0017\ufffd\u0001u\ufffdQ#2\ufffdO\ufffdz\ufffd\\\ufffd\ufffdR\u0002`\ufffd hY\ufffd(\ufffd\ufffd\ufffdg#\u001a\u0017\ufffd\ufffd\u0271\u0006\ufffdb\ufffd\ufffd#\u0010\ufffdS\ufffdp\ufffd@\ufffdFg\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "4fcba5b03ffee145e9eb9aad7e6a50e8e774fb7a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8283214709534175,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "69533619df826a8c170965ea7f0b54f5",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033\ufffd\ufffd>|\ufffd\u0012\ufffd.O\ufffd\ufffdw\ufffd\ufffd\ufffdA\ufffd\u001b\u0019\ufffd\ufffd|7\ufffd\ufffd\ufffdh2\u001f\ufffd \u0017\ufffd\u001a\ufffd\ufffd&\u0017H\ufffd\u0614Ly\u00e48eX\ufffd\ufffd\ufffd\ufffdX\ufffd\ufffd\u0018\u0781\u0565Ie\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "d2b6da58caafbd30e73b1414c3e325f19d773318",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "properties",
    "http_ua_hash": "fad7384d223ed4e6d873d03a31cc652b3a35a481",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "7b82037305b05e4852e4a0d12fe52171d45b0128",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 278,
    "payload_entropy": 5.338633734741194,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "3049539215988761405038bd2258e14fde106d6a",
    "event_fingerprint": "fbbd201a57a7658f004b72c555f154e2902371cc",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "10b88c33b1902b306bc263bae39aa836",
        "payload_hash": "5139797f16cdc96fcff53160dafdfdfc",
        "path_pattern_hash": "f658d71e5b555b6dd4035cc9acb8e173"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS ",
    "event_signature": "6cdc64bc9c11716d6141041a7731b8741e8623f9",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "75f613388f2abb29461cb83101a226d4c51bc3e2",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "eaa807d97ed075164ad06a16fff4f79030561dd8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 205,
    "payload_entropy": 5.28796188212589,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 100,
    "risk_classification": 100,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 100,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 68,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "3049539215988761405038bd2258e14fde106d6a",
    "event_fingerprint": "6efb84d460d9a5597488481ce2ff0acda9bdebe7",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "86fe2281e1dd346a172649461ce86352",
        "payload_hash": "c11c1df2652e3093515dbcf84d6c5683",
        "path_pattern_hash": "f35df1fc019a96ac8898ec6340239854"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:40.0) Gecko\/20100101 Fire",
    "event_signature": "3d6a286061a7509391cdcd495f7c2480b3cd42c6",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "fa624d6a74e6815019d1233ee149beabec7a7fb1",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "16223ed774af363bfa3a19e07c4401628555ae7f",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 182,
    "payload_entropy": 5.242712996289917,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 72,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 72,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 54,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "30ccdd9d15627e91598bbfe8d512731b6bc0f903",
    "event_fingerprint": "6bfc6f60b30452741fd1cbdc3be78ced69cd653b",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "dc0e48bfd7e1775f9fe72e23dd090d93",
        "payload_hash": "a7d3e742810fe2cf215199c7d30293aa",
        "path_pattern_hash": "9a59da8a4826d25b327ad6f6ccd7a0fe"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/appsettings.json HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Jigsaw\/2.2.5 W3C_CSS_Validator_JFouffa\/2.0\r\nAccept-Charse",
    "event_signature": "95999d1b56c43ca7e1089f64cecc596bf0a19928",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.86328141079327,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "711301a78d227c3bb22b8c46b62374fd",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdY0IS0\ufffd3(\ufffd\u0016\ufffd\ufffd\u0017\u0011\ufffd\ufffdbhu\ufffdgq{\ufffdvPA\ufffd\\\ufffd \ufffd\u0013\ufffd\ufffd\ufffdt\u00f0{R\ufffd\ufffdk\ufffd(B\ufffd\ufffdD7\u0018\r\ufffd?Q\ufffd?\ufffdH\ufffd\ufffd\u001c\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "23eb62c962061d94d1ad1b04f89697341919c686",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yml",
    "http_ua_hash": "eb821319645d3730ad2ac9a0bd8bb8c6e7468b3c",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "4b3d6eaad5e661ad8ef2604786363e5d3ff92999",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 196,
    "payload_entropy": 5.329124595341788,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 36,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 36,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 33,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "9dbb02174d2eec2dcddbf6971efc9c6cc763c269",
    "event_fingerprint": "f2e07c0e6951b144e4c426d4d4c52e5b4c319808",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "fbb99fc5cecdb6fc6a6e8e28468accb0",
        "payload_hash": "c6f97962eecb5a76e757ff463c840f49",
        "path_pattern_hash": "94cae2772850e9b686f00a13494f96e5"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.71,
    "classification_confidence": 0.71,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/docker-compose.staging.yml HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Links (2.1pre15; FreeBSD 5.3-RELEASE i386; 196x84)\r",
    "event_signature": "ec9d609dcc22955b215e46c7e8550aa5f65d7385",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.876598905388903,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "5ccd2d1b71e2100b1ddc0ee88e9fdda6",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdQ>\",\ufffd\ufffd\ufffd\u0002)\ufffd\ufffd\ufffd~d\ufffd\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\ufffd#*\ufffd6\ufffd >\ufffd\ufffdN\ufffdfV\ufffd*\ufffd\ufffde5\u3273v]\ufffd\u001a\b\ufffd\u07a5\u001a\ufffd9\ufffd5\ufffdS\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "fef5a1128a5c5a116bf340414c8864eaf778ca2c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.831959131036999,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "c93bd39ce0e120d2b802b198bf9d4d2f",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\r\\\ufffd\u0016+\ufffd14\ufffd \ufffd\ufffd +n>\ufffd\ufffd\ufffd\u0003\ufffd&\ufffd:\ufffd\ufffd\ufffd'\ufffd\ufffdQ [\u070b\u04df^\ufffd\u000b\ufffd \ufffd\ufffd\ufffd\u0010\ufffd\ufffd\u000fWNk\ufffd\u0011Lh\ufffd\ufffded:\ufffdg\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "785e049db168fed5716cca9e190324a99ea2258c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.839713328171477,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "19f5e58c79303cca77b50de44614663e",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdq\ufffd\ufffd\ufffdb\ufffd\u0017bp\ufffd<\ufffd\ufffd\ufffdO\ufffd\ufb6en`\ufffd\ufffd\r\u00175g\\\u0006\ufffd u\ufffd7\ufffd\ufffd\ufffd& J\ufffd\ufffd\ufffd)\f\ufffd\u0087\ufffdZ\ufffd\ufffd\ufffd\u0015\ufffdQ\ufffd+14\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "b583fbea327391ea20d3fa81f00df0be9e17df68",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8880062513153035,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "a1777552955e433e3391897b6b49b55e",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0019\ufffd\ufffd)\ufffd\u02de\ufffd\ufffdvB@\"\ufffdW\ufffd\ufffds\ufffdUt\rM\ufffd5\u0010\ufffd\ufffdE\ufffd\ufffd 3\u001f\ufffd2\u0011\ufffd\ufffd_\ufffd\ufffdR\ufffdc\ufffd\ufffd\u0007\ufffd%\u000f$jL\ufffdf@\ufffd\ufffd6\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "a6d0f06179faa7679f091a5b9aac8df5a98848d3",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8602077648266295,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "2868ef8f24e3921119ef6bb5eb712006",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd|\ufffd\ufffd\ufffd\ufffd\u0484\ufffd\ufffdh\ufffd\u0126\ufffdG7k\ufffd\ufffd\ufffd\ufffd\ufffd\u0012\u0002\u045fR\u0010i %i=\ufffd\ufffd\u0511\ufffd#\u0012s\ufffdQ\u0012\ufffd|(\ufffdU\ufffd\ufffd\r\ufffdt,M\ufffdoF\ufffd3\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "bb24dff7ae4565453f1a43b4cc7218a7d4dc67de",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "yml",
    "http_ua_hash": "3f8181113f324407cae4cf9ea7610d14ead1f6bf",
    "http_host_hash": "cb02367c77f38075a2cc9013ee32fc8b1cbdd795",
    "http_target_hash": "d8b1323b6ef8c906588c7bebedb55eb8820ae5d1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 234,
    "payload_entropy": 5.221942741943405,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 84,
    "risk_classification": 90,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 84,
        "classification": 90,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 59,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "23c34b7b8d0f0f51b819a1c83435c79c47ed9413",
    "event_fingerprint": "bbe60195099f1cb56ee68eabc51a9fdb0b853e89",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b24a961e1b97fc1745e98e5aff42bf2a",
        "payload_hash": "5beb69f93efab8cb1a53193e42d1f03d",
        "path_pattern_hash": "eaee3b34be9f0e8721a1e0c8de81e82c"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/docker-compose.override.yml HTTP\/1.1\r\nHost: 62.3.50.33:8445\r\nUser-Agent: Mozilla\/5.0 (compatible; alexa site audit\/1.0; +ht",
    "event_signature": "9be29ee66376685062639fe8edcb7948c7ab7f86",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.798791619483019,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "f88b6b056ea2bb642309d4d87bdb7cb4",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003N\ufffdab@\ufffd\ufffd?\ufffd\ufffd^\ufffd\ufffd\ufffd\ufffdE\ufffdm=os\ufffd ;*}\ufffd\ufffd\ufffd-\\\u001c \ufffd\u008d\u0010H\ufffd\ufffd\u0000<?\ufffdy u\u0011G>\ufffd\u07a1U\ufffd#\ufffd<\u032d\t\ufffd\ufffd0X\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "1da7fe85576704305885ebc602a0e4998dea6f68",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.793044716580505,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8445,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 31,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "d0d45559ffb5e0ba0bfbff339f713edd3ded5a17",
    "event_fingerprint": "a83dc840d309baac90ab4ac17477e585185fa2c2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "017e39d85cf74272ce918ed50fca2439",
        "path_pattern_hash": "d8864644c15d33be9c0aef2d08c8fc10"
    },
    "target_context": {
        "dst_port": 8445,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003?\u001dP\ufffd\ufffd<R\u001c\ufffd\u001a\ufffd\u0007w>\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffdw\\j\ufffd\r\ufffd&!\u001c\ufffdz \ufffd\ufffd4;\ufffd\ufffdv\u001dH\ufffdrk\ufffd\ufffdD,+\ufffd\ufffdU\ufffdC}\u000e.Px\ufffd9\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "7bf31052afdb663898214cd23e5399407f442b82",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}