{"ip":"35.152.246.200","exported_at":"2026-07-27T20:53:14+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":80,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["path_traversal","config_leak_scan"],"recommended_action":"investigate","confidence":1,"risk_breakdown":{"waf":100,"classification":74,"behavior":0,"geo":40,"protocol":35,"novelty":30},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"T1083","top_mitre_technique":"T1499","top_mitre_count":1714,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":100,"classification":74,"behavior":0,"geo":40,"protocol":35,"novelty":30,"risk_score":78},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":100,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["Http Sensitive","Upstream","Waf Score"],"tags_summary":["INT-http_sensitive","INT-upstream","INT-waf-score"],"attack_vector":"config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eenv%2eorig","protocol_details":{"http_method":"GET","http_path":"\/%2eenv%2eorig","request_line":"GET \/%2eenv%2eorig HTTP\/1.1","http_user_agent":"curl\/8.7.1","port":6789,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/%2eenv%2eorig \u00b7 UA curl\/8.7.1 \u00b7 HTTP:6789","evidence_snippet":"GET \/%2eenv%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:6789\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:","target_port_label":"6789 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 100 % \u2014 5 tag(s) WAF","classification_reason":"Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%","classification_reason_label_fr":"Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF","payload_preview":"GET \/%2eenv%2eorig HTTP\/1.1\r\nHost: 62.3.50.33:6789\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:"},"events":[{"id":12605514,"ip":"35.152.246.200","ts":"2026-07-16 22:44:46.000000","proto":"tcp","src_port":13218,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2eaws\/credentials_cloudwatch","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00222478206130be71fa97dcc7b415f8d9c12efe121a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 393, \u0022payload_entropy\u0022: 5.195359204734876, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b23dffe6620e1fd57aaef0f050f48050f429d61d\u0022, \u0022event_fingerprint\u0022: \u0022ceafde92257803df848c22e845b9379c8b56696f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00228d96f6ece775be79828b27c87d8657f4\u0022, \u0022path_pattern_hash\u0022: \u002225375759cbb43c97828143a0faa7ed9a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/%2eaws\/credentials_cloudwatch HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eaws\/credentials_cloudwatch\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eaws\/credentials_cloudwatch HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eaws\/credentials_cloudwatch HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eaws\/credentials_cloudwatch HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eaws\/credentials_cloudwatch\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eaws\/credentials_cloudwatch HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eaws\/credentials_cloudwatch HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eaws\/credentials_cloudwatch HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220c1c47ce4d4a12e7d190fbae70ded05f6eaccee4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eaws\/credentials_cloudwatch\u0022, \u0022request_line\u0022: \u0022GET \/%2eaws\/credentials_cloudwatch HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2eaws\/credentials_cloudwatch HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eaws\/credentials_cloudwatch\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eaws\/credentials_cloudwatch\u0022, \u0022request_line\u0022: \u0022GET \/%2eaws\/credentials_cloudwatch HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eaws\/credentials_cloudwatch\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2eaws\/credentials_cloudwatch HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":393},{"id":12605515,"ip":"35.152.246.200","ts":"2026-07-16 22:44:46.000000","proto":"tcp","src_port":13220,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/monerod\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00224dbe6d1a6ef787c6e7f6d8ba04baf1a7bb35c088\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 378, \u0022payload_entropy\u0022: 5.165213610181823, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b043a210574bd3f5ec36b26621f5afd1038ef42f\u0022, \u0022event_fingerprint\u0022: \u00222f1843207f9e621838fd4d45fb7351bde2863972\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022f9cc25e2e6d26c6c9ddca1063f88b7ed\u0022, \u0022path_pattern_hash\u0022: \u0022579df7f52135e88b379ea36ea22e7cab\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/monerod\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/monerod\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/monerod\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/monerod\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/monerod\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/monerod\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/monerod\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/monerod\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/monerod\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002252fe983256149217da486e62a5f139f77378d9c4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/monerod\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/monerod\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/monerod\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/monerod\/%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/monerod\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/monerod\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/monerod\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/monerod\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":378},{"id":12605517,"ip":"35.152.246.200","ts":"2026-07-16 22:44:46.000000","proto":"tcp","src_port":13228,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":37,"waf_tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/db\/config%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022ce37439f86300a0ce9c638d7d6c613f0e8173127\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.200788903436346, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022997b5ec9f1ca007f3b1a83ac96376b6136bf28a0\u0022, \u0022event_fingerprint\u0022: \u002244b77ba3100d1e4a9c093e010207ecf6b7fd08d6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00223d831136eb341db92d70057b0b4e32c7\u0022, \u0022path_pattern_hash\u0022: \u002248661daefca71b67c81109cd92ba3d56\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/db\/config%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db\/config%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db\/config%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db\/config%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/db\/config%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db\/config%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db\/config%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db\/config%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/db\/config%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022512bb9ef2e90fe0bf4fa4b1cc58b6964305b608a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db\/config%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/db\/config%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/db\/config%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db\/config%2eyml\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db\/config%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/db\/config%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db\/config%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/db\/config%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_db\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_db\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12605518,"ip":"35.152.246.200","ts":"2026-07-16 22:44:46.000000","proto":"tcp","src_port":13230,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/public_html\/%2eenv%2elocal","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002276857adf7a506ba98ea3c9ead3a8a5eedd693519\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 390, \u0022payload_entropy\u0022: 5.221580367867972, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b043a210574bd3f5ec36b26621f5afd1038ef42f\u0022, \u0022event_fingerprint\u0022: \u0022ada2df922e31b124d62ede523b3356c3fb8b2294\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002209f49cc5dec754dfb42fb7acf88c6d2f\u0022, \u0022path_pattern_hash\u0022: \u0022658299c8757f42650ced1abdac4c1d6d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/public_html\/%2eenv%2elocal HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/public_html\/%2eenv%2elocal\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/public_html\/%2eenv%2elocal HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/public_html\/%2eenv%2elocal HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/public_html\/%2eenv%2elocal HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/public_html\/%2eenv%2elocal\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/public_html\/%2eenv%2elocal HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/public_html\/%2eenv%2elocal HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/public_html\/%2eenv%2elocal HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022da74c19856f1146522e5fda3fbdf5bf15aa71e84\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/public_html\/%2eenv%2elocal\u0022, \u0022request_line\u0022: \u0022GET \/public_html\/%2eenv%2elocal HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/public_html\/%2eenv%2elocal HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/public_html\/%2eenv%2elocal\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/public_html\/%2eenv%2elocal\u0022, \u0022request_line\u0022: \u0022GET \/public_html\/%2eenv%2elocal HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/public_html\/%2eenv%2elocal\u0022, \u0022evidence_snippet\u0022: \u0022GET \/public_html\/%2eenv%2elocal HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":390},{"id":12605519,"ip":"35.152.246.200","ts":"2026-07-16 22:44:46.000000","proto":"tcp","src_port":13234,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/backend\/config\/settings%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00226dc506eb171af03372c9e5eb289f527b02d3892d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 393, \u0022payload_entropy\u0022: 5.213171096722682, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002262ea003d1993381786fc60c009eff963a3eea72a\u0022, \u0022event_fingerprint\u0022: \u0022803443f22df44725c31507b3e867afd78edb5a65\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002232e6283129a4a59d6e6faeb734defcee\u0022, \u0022path_pattern_hash\u0022: \u00229bcbdf922d39055333b0f3c6ebd644c9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/backend\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backend\/config\/settings%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backend\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backend\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127\u0022, \u0022payload_snippet\u0022: \u0022GET \/backend\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backend\/config\/settings%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backend\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backend\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127\u0022, \u0022payload_snippet\u0022: \u0022GET \/backend\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002212b73404691140495d15b91a2fc21db325871e51\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backend\/config\/settings%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/backend\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backend\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backend\/config\/settings%2eyml\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backend\/config\/settings%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/backend\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backend\/config\/settings%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backend\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":393},{"id":12605520,"ip":"35.152.246.200","ts":"2026-07-16 22:44:46.000000","proto":"tcp","src_port":13238,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/backup%2erb","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002276aa707bf121681eb9fb345534bb0928cababc0a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 375, \u0022payload_entropy\u0022: 5.172770254887424, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00229193ef42eca4bf4a8a54ad8797d797c582cc331c\u0022, \u0022event_fingerprint\u0022: \u0022da7c1247862d60210f192047e67c813a89bb720a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022edb8c759d5d6afd4b9259a884edf7660\u0022, \u0022path_pattern_hash\u0022: \u0022e4f11057e8432a3f50a9a19cae19abfa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/backup%2erb HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup%2erb\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backup%2erb HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup%2erb HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup%2erb HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup%2erb\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backup%2erb HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup%2erb HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup%2erb HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002202433b34ef1c59d4f04df4a9633f1a8b0f856e64\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup%2erb\u0022, \u0022request_line\u0022: \u0022GET \/backup%2erb HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backup%2erb HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup%2erb\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup%2erb\u0022, \u0022request_line\u0022: \u0022GET \/backup%2erb HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup%2erb\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backup%2erb HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":375},{"id":12605521,"ip":"35.152.246.200","ts":"2026-07-16 22:44:46.000000","proto":"tcp","src_port":13250,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/sandbox\/test%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002296550532a4ed87209daa952d24943f8689318ccd\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 382, \u0022payload_entropy\u0022: 5.194565738664215, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00225254eece20c9a4f2083283a434108bafae3e8763\u0022, \u0022event_fingerprint\u0022: \u0022b7be928d18c2358988657d81764370d92ad56dec\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c78406c2901040038bd0c527d994378c\u0022, \u0022path_pattern_hash\u0022: \u0022e0cf922f22b7ec2bfee1551609ff792b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/sandbox\/test%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/sandbox\/test%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/sandbox\/test%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/sandbox\/test%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/sandbox\/test%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/sandbox\/test%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/sandbox\/test%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/sandbox\/test%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/sandbox\/test%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ffb5493cd9a7755c8e01450d0f197eaae63c3c2b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/sandbox\/test%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/sandbox\/test%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/sandbox\/test%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/sandbox\/test%2ephp\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/sandbox\/test%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/sandbox\/test%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/sandbox\/test%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/sandbox\/test%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":382},{"id":12605522,"ip":"35.152.246.200","ts":"2026-07-16 22:44:46.000000","proto":"tcp","src_port":13262,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/repository%2ejs","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022ff57f667c967bb87f574b271bb9202f75e9892d3\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.190785919992423, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00223f77a60118bff867a27e3a6cd5f3571b0d4f6b43\u0022, \u0022event_fingerprint\u0022: \u00228a7489390e83524d73e5da07477e0bf977755732\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022ba5030b215f2128f3155ea66e1a8e11d\u0022, \u0022path_pattern_hash\u0022: \u002230e51eb5c0bc4d10aa603feaa057ed4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/config\/repository%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/repository%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/repository%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/repository%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/repository%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/repository%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/repository%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/repository%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/repository%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e82ff0ce5b000ead44af15466eafa4df96abf17d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/repository%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/config\/repository%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/repository%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/repository%2ejs\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/repository%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/config\/repository%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/repository%2ejs\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/repository%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12605523,"ip":"35.152.246.200","ts":"2026-07-16 22:44:46.000000","proto":"tcp","src_port":13278,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2eenv%2eorig","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022b40ba2a44b68e9a39d14e7977dc214f21b6e3ef2\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.1550102035073255, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022ba92d82db8e2d74baeaa36903c21b11b21fb539c\u0022, \u0022event_fingerprint\u0022: \u0022b9c9bf27195beb9a816adeb7914e694e74b71826\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00228d6d0ebe9f48d7510e3a19b84c875546\u0022, \u0022path_pattern_hash\u0022: \u00228bf5697a43b6e34df8b9489f416f53c8\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/%2eenv%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eenv%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eenv%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eenv%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eenv%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eenv%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eenv%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eenv%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eenv%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002271d5eb119bf6dd9e798fb0f2d8c74958829427a6\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eenv%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/%2eenv%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2eenv%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eenv%2eorig\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eenv%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/%2eenv%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eenv%2eorig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2eenv%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12605500,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13082,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/env\/smtp_credentials%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002269cfb9559f350aec859e6a7a997c961642c95b00\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 391, \u0022payload_entropy\u0022: 5.2036302437657715, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002285621b6abbfa4487de1a79a36d79a3937f9b2462\u0022, \u0022event_fingerprint\u0022: \u002295769702474fc6d0cc2c82823d617ce012a1236f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b0fa48d435a96141d1cc06bac9d86e26\u0022, \u0022path_pattern_hash\u0022: \u002243cf212bab53f62ac25e84541741173a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/env\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/env\/smtp_credentials%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/env\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/env\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/env\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/env\/smtp_credentials%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/env\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/env\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/env\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229cae6c33117941951b0913769912ae3f9ea81a12\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/env\/smtp_credentials%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/env\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/env\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/env\/smtp_credentials%2ejson\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/env\/smtp_credentials%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/env\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/env\/smtp_credentials%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/env\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_env\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_env\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":391},{"id":12605501,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13098,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/Nodejs-Projects\/play-ground\/login\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 4, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022c6e00f73421fab679318b35d5425244111d5c3ed\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 404, \u0022payload_entropy\u0022: 5.219290700533595, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b043a210574bd3f5ec36b26621f5afd1038ef42f\u0022, \u0022event_fingerprint\u0022: \u0022aa684f13845e94b9e08559ed15ec47ccc92ed79a\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022d065313468a5bf3442b52213ad25869f\u0022, \u0022path_pattern_hash\u0022: \u00224943945e0b764a9af6b5d8f51ec2398f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/Nodejs-Projects\/play-ground\/login\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encod\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/Nodejs-Projects\/play-ground\/login\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/Nodejs-Projects\/play-ground\/login\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/Nodejs-Projects\/play-ground\/login\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/Nodejs-Projects\/play-ground\/login\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encod\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/Nodejs-Projects\/play-ground\/login\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/Nodejs-Projects\/play-ground\/login\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/Nodejs-Projects\/play-ground\/login\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/Nodejs-Projects\/play-ground\/login\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encod\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f6f71b89a1b82875daf6ad4a00e3eca1777cec25\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/Nodejs-Projects\/play-ground\/login\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/Nodejs-Projects\/play-ground\/login\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/Nodejs-Projects\/play-ground\/login\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encod\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/Nodejs-Projects\/play-ground\/login\/%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/Nodejs-Projects\/play-ground\/login\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/Nodejs-Projects\/play-ground\/login\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/Nodejs-Projects\/play-ground\/login\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/Nodejs-Projects\/play-ground\/login\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encod\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":404},{"id":12605502,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13110,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/src\/mailgun_config%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002299687342b4e35324e780cdcc794ac817e6e2c8e5\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.202635238787742, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b23dffe6620e1fd57aaef0f050f48050f429d61d\u0022, \u0022event_fingerprint\u0022: \u002294f7cff4092c92e0cba1639eed6b167fccb1b6ca\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941150\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00229279274a09e32746be8fc1e1b3bacccb\u0022, \u0022path_pattern_hash\u0022: \u00229c208ed2d60c9cf088c17519465740cb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/src\/mailgun_config%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/mailgun_config%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/mailgun_config%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/mailgun_config%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/mailgun_config%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/mailgun_config%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/mailgun_config%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/mailgun_config%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/mailgun_config%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022767aa63f72104d7d6ba10a8dab90b2bf8fbb1272\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/mailgun_config%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/src\/mailgun_config%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/src\/mailgun_config%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/mailgun_config%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/mailgun_config%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/src\/mailgun_config%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/mailgun_config%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/src\/mailgun_config%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12605503,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13122,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/_next\/static\/chunks\/webpack-[hash]%2ejs","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 4, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022122d152d8332f9e88c8eae50502613c476be59eb\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 403, \u0022payload_entropy\u0022: 5.273929050823469, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b23dffe6620e1fd57aaef0f050f48050f429d61d\u0022, \u0022event_fingerprint\u0022: \u00223f976939defb2a344cb3efafc8dc1e7256f500f7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022bfa727ccdaf15698c4faeb37f0aee7f4\u0022, \u0022path_pattern_hash\u0022: \u0022b1e64e8e6b29ef0b1dc771e52ac6039f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/_next\/static\/chunks\/webpack-[hash]%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_next\/static\/chunks\/webpack-[hash]%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_next\/static\/chunks\/webpack-[hash]%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_next\/static\/chunks\/webpack-[hash]%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/_next\/static\/chunks\/webpack-[hash]%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_next\/static\/chunks\/webpack-[hash]%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_next\/static\/chunks\/webpack-[hash]%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_next\/static\/chunks\/webpack-[hash]%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/_next\/static\/chunks\/webpack-[hash]%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a2a8aa408acbe24f300525219f17e1affb16b378\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_next\/static\/chunks\/webpack-[hash]%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/_next\/static\/chunks\/webpack-[hash]%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/_next\/static\/chunks\/webpack-[hash]%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_next\/static\/chunks\/webpack-[hash]%2ejs\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_next\/static\/chunks\/webpack-[hash]%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/_next\/static\/chunks\/webpack-[hash]%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_next\/static\/chunks\/webpack-[hash]%2ejs\u0022, \u0022evidence_snippet\u0022: \u0022GET \/_next\/static\/chunks\/webpack-[hash]%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":403},{"id":12605504,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13138,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":35,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/deployment\/phpinfo%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022e22a56700aea7fabb55f3a67f8cfc3850fbc8790\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.210645635324521, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00226f821836aae4a38484c5e27fec80d38f467874bc\u0022, \u0022event_fingerprint\u0022: \u002289599aed92ab2e8e863cd840be5a6a0195d03cde\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022d04937d772f17e9c31be926494a33c51\u0022, \u0022path_pattern_hash\u0022: \u0022c9a54464c5bdf56e6c0053eb650ba7fe\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/deployment\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/deployment\/phpinfo%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022phpinfo\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/deployment\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/deployment\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/deployment\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/deployment\/phpinfo%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022phpinfo\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/deployment\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/deployment\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/deployment\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228f321644c774701e5e018ce24009ce9b6462421a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/deployment\/phpinfo%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/deployment\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/deployment\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/deployment\/phpinfo%2ephp\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/deployment\/phpinfo%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/deployment\/phpinfo%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/deployment\/phpinfo%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/deployment\/phpinfo%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950614:phpinfo\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12605505,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13140,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/azure-credentials_codebuild","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00225fe5f79d5edbf798ff12732c4d21564ba464adc9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 391, \u0022payload_entropy\u0022: 5.1696235672527555, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002244d14a95588d930efc47b50d1f18a43f88507c3f\u0022, \u0022event_fingerprint\u0022: \u002200feb87d616a2f90ad570c3fbaed2c9a9a29300e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00221fff62f4e2745da93bf6a92507efb017\u0022, \u0022path_pattern_hash\u0022: \u00225c1c5625178d4fd423dc5d21bc6bd1cc\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/azure-credentials_codebuild HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/azure-credentials_codebuild\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/azure-credentials_codebuild HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/azure-credentials_codebuild HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/azure-credentials_codebuild HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/azure-credentials_codebuild\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/azure-credentials_codebuild HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/azure-credentials_codebuild HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/azure-credentials_codebuild HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002269bea485433f17fe9f882c3b69743ef3bd595af2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/azure-credentials_codebuild\u0022, \u0022request_line\u0022: \u0022GET \/azure-credentials_codebuild HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/azure-credentials_codebuild HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/azure-credentials_codebuild\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/azure-credentials_codebuild\u0022, \u0022request_line\u0022: \u0022GET \/azure-credentials_codebuild HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/azure-credentials_codebuild\u0022, \u0022evidence_snippet\u0022: \u0022GET \/azure-credentials_codebuild HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":391},{"id":12605506,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13154,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/src\/config\/sendgrid_api_key%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00228db9d769ff14dd5fd431835898105f509e589f13\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 397, \u0022payload_entropy\u0022: 5.223554177838062, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b23dffe6620e1fd57aaef0f050f48050f429d61d\u0022, \u0022event_fingerprint\u0022: \u002249d93f5f2f26bf67afd9d9fe1f0fc0e3dc46fb2f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941150\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002253dc3f9424823de8c6f661eb63789dc0\u0022, \u0022path_pattern_hash\u0022: \u0022189e0507368f66678841665377cebc79\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/src\/config\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/config\/sendgrid_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/config\/sendgrid_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/config\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP:\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/config\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/config\/sendgrid_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/config\/sendgrid_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/config\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP:\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/config\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002294cff42e321bd714bdfa78a9511230072cd5d831\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/config\/sendgrid_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/src\/config\/sendgrid_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/src\/config\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/config\/sendgrid_api_key%2etxt\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/config\/sendgrid_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/src\/config\/sendgrid_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/config\/sendgrid_api_key%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/src\/config\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":397},{"id":12605507,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13158,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api-key_codebuild%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022d5a1596cdecfc3e2ea1e46f1423d6f8403d67d7f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.205664644011765, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002244d14a95588d930efc47b50d1f18a43f88507c3f\u0022, \u0022event_fingerprint\u0022: \u00224eafd5ae308c3579f9fdf44a5599230d8fb969f6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00224300f0802d5e52ed8a1f71dbadf0bec4\u0022, \u0022path_pattern_hash\u0022: \u0022a2e6f2d951ce88963f43aa6fcdaf9b9d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/api-key_codebuild%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_codebuild%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_codebuild%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_codebuild%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_codebuild%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_codebuild%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_codebuild%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_codebuild%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_codebuild%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022119a372e72da17e4872344e571c6f98d771dbfd1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_codebuild%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_codebuild%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api-key_codebuild%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_codebuild%2etxt\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_codebuild%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_codebuild%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_codebuild%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api-key_codebuild%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12605508,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13174,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/Archipel\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022970e7dd895346c5c9e6ea8c99d637df59e29fec2\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.16928884094175, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b043a210574bd3f5ec36b26621f5afd1038ef42f\u0022, \u0022event_fingerprint\u0022: \u00222b1af6e884b4f5367b8c32b0e2c86951ded402f8\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00222ddc966c99a83b682d4e626b8eec1bf3\u0022, \u0022path_pattern_hash\u0022: \u002255c57eb84e6d92a3876af8eb79ec88f8\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/Archipel\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/Archipel\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/Archipel\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/Archipel\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/Archipel\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/Archipel\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/Archipel\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/Archipel\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/Archipel\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220dd228d96fb3c3f126f0a1a098d7a47f13cf576b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/Archipel\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/Archipel\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/Archipel\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/Archipel\/%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/Archipel\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/Archipel\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/Archipel\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/Archipel\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12605509,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13180,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/mail\/mailjet_key%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00227d10bf05a6fcd03934f1ee0bdb0d1a863a305055\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.220508304191226, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00226601551c83fa55964a1b094901eee205a98831c7\u0022, \u0022event_fingerprint\u0022: \u0022793247b8920e55c24fba8b0eb9972b44e2e9ac9e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002232f66f4b95d19ca2db67b33f7ddd6007\u0022, \u0022path_pattern_hash\u0022: \u002238113909cfc28befe1565b72d76b58f5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/mail\/mailjet_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/mail\/mailjet_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/mail\/mailjet_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/mail\/mailjet_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/mail\/mailjet_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/mail\/mailjet_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/mail\/mailjet_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/mail\/mailjet_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/mail\/mailjet_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222cd296df23ab25065e5def72ab773d16e3420135\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/mail\/mailjet_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/mail\/mailjet_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/mail\/mailjet_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/mail\/mailjet_key%2etxt\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/mail\/mailjet_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/mail\/mailjet_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/mail\/mailjet_key%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/mail\/mailjet_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_mail\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_mail\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12605510,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13196,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/config\/debug%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002280e453bb10e9b2d810ccf269a3b1ee2464a4b489\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.201953544387442, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002257e446cb8d9e202607cd4c30bd1aa1331e1f1147\u0022, \u0022event_fingerprint\u0022: \u002255c884cbd6c71a1fd3ebd28560cec9c525c9f97f\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022aefa879a1fe73f87fca43a2507f4dcf8\u0022, \u0022path_pattern_hash\u0022: \u0022112b4a32474935ebe588c5e719021719\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/admin\/config\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/config\/debug%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/config\/debug%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/config\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/config\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/config\/debug%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/config\/debug%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/config\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/config\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fe1ee894d4ce3ba4f06ce87effea641bfec7f852\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/config\/debug%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/config\/debug%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/config\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/config\/debug%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/config\/debug%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/config\/debug%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/config\/debug%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/config\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12605512,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13200,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/mailer\/mailer%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00228a630926dbcb6f201fc3d3dcb69ba4374101cffe\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.173342643726513, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b23dffe6620e1fd57aaef0f050f48050f429d61d\u0022, \u0022event_fingerprint\u0022: \u0022c073a3d03d4e41962f048f6a4e1b2354dec07350\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b125115025a3d4551bba6bb5240f6c3b\u0022, \u0022path_pattern_hash\u0022: \u00227240ac0ceb5e1dc86c3b98d8bb0ca55e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/mailer\/mailer%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/mailer\/mailer%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/mailer\/mailer%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/mailer\/mailer%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/mailer\/mailer%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/mailer\/mailer%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/mailer\/mailer%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/mailer\/mailer%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/mailer\/mailer%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226dca523ade8bc21912e223fdc2dea1ca9c23b5c4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/mailer\/mailer%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/mailer\/mailer%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/mailer\/mailer%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/mailer\/mailer%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/mailer\/mailer%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/mailer\/mailer%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/mailer\/mailer%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/mailer\/mailer%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12605513,"ip":"35.152.246.200","ts":"2026-07-16 22:44:45.000000","proto":"tcp","src_port":13212,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/k8s\/priorityclass%2eyaml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022003ece4e994240652ca45ab327134f6e7629fe08\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.208236026631288, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b23dffe6620e1fd57aaef0f050f48050f429d61d\u0022, \u0022event_fingerprint\u0022: \u002208ad76fe8577a15041b4b93e06207d2010d13036\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00229ed3b9012bcacd13193e9d2d4ca69c37\u0022, \u0022path_pattern_hash\u0022: \u0022fc0743672ed6c852f1ded2cb978fa2ce\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/k8s\/priorityclass%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/k8s\/priorityclass%2eyaml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/k8s\/priorityclass%2eyaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/k8s\/priorityclass%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/k8s\/priorityclass%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/k8s\/priorityclass%2eyaml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/k8s\/priorityclass%2eyaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/k8s\/priorityclass%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/k8s\/priorityclass%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224c0ee25b28a5af6ccb7e4649794274e3ea08fad7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/k8s\/priorityclass%2eyaml\u0022, \u0022request_line\u0022: \u0022GET \/k8s\/priorityclass%2eyaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/k8s\/priorityclass%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/k8s\/priorityclass%2eyaml\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/k8s\/priorityclass%2eyaml\u0022, \u0022request_line\u0022: \u0022GET \/k8s\/priorityclass%2eyaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/k8s\/priorityclass%2eyaml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/k8s\/priorityclass%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12605486,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":12970,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/keys\/config%2ejs","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022f93f63a22ca486be6d24025d4103042d7111a5b8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.2025410331038975, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002277928053772017a4d4091922e871ed10b72e4939\u0022, \u0022event_fingerprint\u0022: \u0022490aeb5f09acf656e64947dfe83919be2b455f1b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022428385f89426ba194d7e139c1e5a6129\u0022, \u0022path_pattern_hash\u0022: \u00226ebdaca3670a45d896ee764a4039f17e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/api\/keys\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/keys\/config%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/keys\/config%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/keys\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/keys\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/keys\/config%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/keys\/config%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/keys\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/keys\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f483fd4be47add85768dab739529c2f05bda829d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/keys\/config%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/api\/keys\/config%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/keys\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/keys\/config%2ejs\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/keys\/config%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/api\/keys\/config%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/keys\/config%2ejs\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/keys\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12605487,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":12972,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/deploy\/config%2eini","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022babaa143d8a7b100e8d96e19f8c107be7b808ab6\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.176728049775048, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002262ea003d1993381786fc60c009eff963a3eea72a\u0022, \u0022event_fingerprint\u0022: \u0022b6605286d0c354f214e921426eada40cb8e4140d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a64a83d9114b4ed6c194e7ccfaaf5344\u0022, \u0022path_pattern_hash\u0022: \u00221fedeb94d4fa140887c787c193ed6c3c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/deploy\/config%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/deploy\/config%2eini\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/deploy\/config%2eini HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/deploy\/config%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/deploy\/config%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/deploy\/config%2eini\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/deploy\/config%2eini HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/deploy\/config%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/deploy\/config%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a210e1b76955c8ae5af3204fa662820eb3cc65c9\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/deploy\/config%2eini\u0022, \u0022request_line\u0022: \u0022GET \/deploy\/config%2eini HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/deploy\/config%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/deploy\/config%2eini\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/deploy\/config%2eini\u0022, \u0022request_line\u0022: \u0022GET \/deploy\/config%2eini HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/deploy\/config%2eini\u0022, \u0022evidence_snippet\u0022: \u0022GET \/deploy\/config%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12605488,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":12984,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config%2einc","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002230c33decfe6d13df86a45ba77a95e20680b86db9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 376, \u0022payload_entropy\u0022: 5.153188160973078, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002244d14a95588d930efc47b50d1f18a43f88507c3f\u0022, \u0022event_fingerprint\u0022: \u0022584331f44f67dca9e9c4b506ad270967ef152dd7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002277c526c2382321f19b5ec6efe67f6a03\u0022, \u0022path_pattern_hash\u0022: \u0022ec71ee5531fd3e1890cb680d8e387f20\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/config%2einc HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: \u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config%2einc\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config%2einc HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config%2einc HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/config%2einc HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config%2einc\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config%2einc HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config%2einc HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/config%2einc HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228557bae55257d11f29a6f7219e9e0d7981b8b68d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config%2einc\u0022, \u0022request_line\u0022: \u0022GET \/config%2einc HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config%2einc HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config%2einc\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config%2einc\u0022, \u0022request_line\u0022: \u0022GET \/config%2einc HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config%2einc\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config%2einc HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":376},{"id":12605489,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":13000,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/token%2econf","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022688171d5f242b5bf0d3c2ad90b79317375f79fb0\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 376, \u0022payload_entropy\u0022: 5.156324323184949, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00223849be7dc6ab7cba573c335d142d0b9771072d08\u0022, \u0022event_fingerprint\u0022: \u0022fca6f1332adb502c240fc66385a239cce3c56fe4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0477\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022Cred Generic token path\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0477\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002207ea9111abed5281c45751937308431b\u0022, \u0022path_pattern_hash\u0022: \u0022eebe21c2bd967032574b64c669206497\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/token%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: \u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/token%2econf\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/token%2econf HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/token%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/token%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/token%2econf\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/token%2econf HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/token%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/token%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221619a4db2fadc42b325381b2bfec6a0e6a6cc10c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/token%2econf\u0022, \u0022request_line\u0022: \u0022GET \/token%2econf HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/token%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/token%2econf\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/token%2econf\u0022, \u0022request_line\u0022: \u0022GET \/token%2econf HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/token%2econf\u0022, \u0022evidence_snippet\u0022: \u0022GET \/token%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_oauth_probe\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_oauth_probe\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":376},{"id":12605490,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":13006,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/backup\/config%2ets","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022564a4e814698171437d14e7d4a2ad4337eda87d6\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 382, \u0022payload_entropy\u0022: 5.188364490150512, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002234df74535f4e8be4c264576abb97818775d3a4f4\u0022, \u0022event_fingerprint\u0022: \u002238d8b4e8e07ca48bb515538acc6e0494d355fc00\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002216bb6770660a458bb8f2f89df9a1b854\u0022, \u0022path_pattern_hash\u0022: \u0022c022bc60344864fe1a52159ab3f7409d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/backup\/config%2ets HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup\/config%2ets\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backup\/config%2ets HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup\/config%2ets HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup\/config%2ets HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/backup\/config%2ets\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/backup\/config%2ets HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/backup\/config%2ets HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/backup\/config%2ets HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d086d5d590744858ec5b71866992576155bb4116\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup\/config%2ets\u0022, \u0022request_line\u0022: \u0022GET \/backup\/config%2ets HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/backup\/config%2ets HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup\/config%2ets\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/backup\/config%2ets\u0022, \u0022request_line\u0022: \u0022GET \/backup\/config%2ets HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/backup\/config%2ets\u0022, \u0022evidence_snippet\u0022: \u0022GET \/backup\/config%2ets HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_backup\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_backup\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":382},{"id":12605491,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":13016,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/_cat\/master","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00225822fa419c5cdf008f54e42629a65dd8d1fc58ff\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 375, \u0022payload_entropy\u0022: 5.15967426771881, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002231670936a4ea806c6ae153abbab26b51d2096074\u0022, \u0022event_fingerprint\u0022: \u002202df3adf08e7142b97a447e21a5db1f76f20a71a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00227ee083dd994adac09262585d468a293f\u0022, \u0022path_pattern_hash\u0022: \u0022c463027d319d76438ee93dca4c9b946f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/_cat\/master HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_cat\/master\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_cat\/master HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_cat\/master HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/_cat\/master HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_cat\/master\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_cat\/master HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_cat\/master HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/_cat\/master HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022231a6bcf53c2329ee25e6b216618568893fa878c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_cat\/master\u0022, \u0022request_line\u0022: \u0022GET \/_cat\/master HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/_cat\/master HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_cat\/master\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_cat\/master\u0022, \u0022request_line\u0022: \u0022GET \/_cat\/master HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_cat\/master\u0022, \u0022evidence_snippet\u0022: \u0022GET \/_cat\/master HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_elastic\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_elastic\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":375},{"id":12605492,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":13018,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/dump%2etar%2egz","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002295ca4dd0ce6c55b5cb3eca5b45ec4c2c33027913\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.1705024416868754, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d2971cb24c87cbd071c3d34f905e4e31379653b7\u0022, \u0022event_fingerprint\u0022: \u0022cf44cde4233a9bd41c25ce339754308755f81bab\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022a3162b9521f945e68a4ecb02b7a3b414\u0022, \u0022path_pattern_hash\u0022: \u002252f6eb2f170d3dd95b17187f7491ec05\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/dump%2etar%2egz HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/dump%2etar%2egz\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/dump%2etar%2egz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/dump%2etar%2egz HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/dump%2etar%2egz HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/dump%2etar%2egz\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/dump%2etar%2egz HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/dump%2etar%2egz HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/dump%2etar%2egz HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220d81acf5a60ea13c44610d5386d54923c04183ec\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/dump%2etar%2egz\u0022, \u0022request_line\u0022: \u0022GET \/dump%2etar%2egz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/dump%2etar%2egz HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/dump%2etar%2egz\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/dump%2etar%2egz\u0022, \u0022request_line\u0022: \u0022GET \/dump%2etar%2egz HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/dump%2etar%2egz\u0022, \u0022evidence_snippet\u0022: \u0022GET \/dump%2etar%2egz HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12605493,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":13024,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/sql\/index%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022ee155fd362ebfc726a0731641e399705ca53023b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.208450550357036, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e040918b12c7e1dfab7f3ef2990eb6fa652e5236\u0022, \u0022event_fingerprint\u0022: \u0022079321e46ac3f1fa6b1b3c07d88b2ac981f743c6\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00221ec1daf2986b8dc06c09955b07c5ee79\u0022, \u0022path_pattern_hash\u0022: \u0022dede995994e9883ec9aa057006c3b9c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/config\/sql\/index%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sql\/index%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sql\/index%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sql\/index%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sql\/index%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sql\/index%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sql\/index%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sql\/index%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sql\/index%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002262a6a470b6defc338143026d8949b146c50294e3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sql\/index%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sql\/index%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/sql\/index%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sql\/index%2ebak\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sql\/index%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sql\/index%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sql\/index%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/sql\/index%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12605494,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":13028,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/db%2etemp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022131037866b96641805d3700acdb26bd7c932f95f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 373, \u0022payload_entropy\u0022: 5.166766461979558, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002244d14a95588d930efc47b50d1f18a43f88507c3f\u0022, \u0022event_fingerprint\u0022: \u0022b33a3a412dc1c8928cddb7dcafff87171043caf8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022de37562f0637dc8500e640c27f947984\u0022, \u0022path_pattern_hash\u0022: \u002254f688a4a88bae9e3c9007234ba7aa72\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/db%2etemp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db%2etemp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db%2etemp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db%2etemp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Client-\u0022, \u0022payload_snippet\u0022: \u0022GET \/db%2etemp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db%2etemp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db%2etemp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db%2etemp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Client-\u0022, \u0022payload_snippet\u0022: \u0022GET \/db%2etemp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ddb0fe508330aa2bfe83f0acfc5231fff9dc35bf\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db%2etemp\u0022, \u0022request_line\u0022: \u0022GET \/db%2etemp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/db%2etemp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db%2etemp\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db%2etemp\u0022, \u0022request_line\u0022: \u0022GET \/db%2etemp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db%2etemp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/db%2etemp HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":373},{"id":12605495,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":13034,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":45,"waf_tags":"[\u0022950312:lfi-13\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/var\/www\/html\/prismic\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 5, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00222b9d7da0f7a53556c33ae51932462f5db9cddb8f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 391, \u0022payload_entropy\u0022: 5.220843358090307, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002216c8a8b50ba91d2e9cd158034da2ad62267212f9\u0022, \u0022event_fingerprint\u0022: \u002286c39fcf61357cbadef53c9b5f714fc04e13def5\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002298068d9d82298205ebebc932551b10f9\u0022, \u0022path_pattern_hash\u0022: \u0022349118e4307813bead4872df9574aab7\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/var\/www\/html\/prismic\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/var\/www\/html\/prismic\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950312:lfi-13\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-13\u0022, \u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/var\/www\/html\/prismic\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/var\/www\/html\/prismic\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/var\/www\/html\/prismic\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/var\/www\/html\/prismic\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950312:lfi-13\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-13\u0022, \u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/var\/www\/html\/prismic\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/var\/www\/html\/prismic\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/var\/www\/html\/prismic\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002292622e5ac41fe4d0fbed4dcaf4a18c6e7fc589d7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/var\/www\/html\/prismic\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/var\/www\/html\/prismic\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/var\/www\/html\/prismic\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/var\/www\/html\/prismic\/%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 7 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-13 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/var\/www\/html\/prismic\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/var\/www\/html\/prismic\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/var\/www\/html\/prismic\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/var\/www\/html\/prismic\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 7 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950312:lfi-13\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950312:lfi-13\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":391},{"id":12605496,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":13046,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/dump%2emongodump%2ezip","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002243108d5d4a7a5b41edf8e196279dafc2c6fa50b0\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.1933578547617305, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022d2971cb24c87cbd071c3d34f905e4e31379653b7\u0022, \u0022event_fingerprint\u0022: \u00225725065e5e28993ef5a047a33af45437e4adaf14\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220a676f47a5283312f562525980ed260e\u0022, \u0022path_pattern_hash\u0022: \u00228ea0b6e17e9e417ef424f188eb022014\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/dump%2emongodump%2ezip HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/dump%2emongodump%2ezip\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/dump%2emongodump%2ezip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/dump%2emongodump%2ezip HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/dump%2emongodump%2ezip HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/dump%2emongodump%2ezip\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/dump%2emongodump%2ezip HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/dump%2emongodump%2ezip HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/dump%2emongodump%2ezip HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227b061a7200d942215ae49115c393c890d7947aac\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/dump%2emongodump%2ezip\u0022, \u0022request_line\u0022: \u0022GET \/dump%2emongodump%2ezip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/dump%2emongodump%2ezip HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/dump%2emongodump%2ezip\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/dump%2emongodump%2ezip\u0022, \u0022request_line\u0022: \u0022GET \/dump%2emongodump%2ezip HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/dump%2emongodump%2ezip\u0022, \u0022evidence_snippet\u0022: \u0022GET \/dump%2emongodump%2ezip HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12605497,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":13054,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/web-app\/client\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00225bb9fc4114dd861582a7a807e6957e44b261c90c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.1739503073970265, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b043a210574bd3f5ec36b26621f5afd1038ef42f\u0022, \u0022event_fingerprint\u0022: \u0022676c1f8b488991c27ae1c69651d2946252a002c8\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e7186805c3b5afdf75980b3f7a962870\u0022, \u0022path_pattern_hash\u0022: \u0022e9aad6e1f2028ddf213bbdf133d80f45\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/web-app\/client\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web-app\/client\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/web-app\/client\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web-app\/client\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web-app\/client\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/web-app\/client\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/web-app\/client\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/web-app\/client\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/web-app\/client\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e306030a4e63b1c5b57167b564bbd86b47326461\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web-app\/client\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/web-app\/client\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/web-app\/client\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/web-app\/client\/%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/web-app\/client\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/web-app\/client\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/web-app\/client\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/web-app\/client\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12605498,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":13064,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/dashboard\/%2essh\/authorized_keys","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022e695ca5a63a358176ffc1cef1a848be6fdd83fab\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 396, \u0022payload_entropy\u0022: 5.239547335431989, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002222f8648d45acd9797a18f2b14f65bd62c27cfac1\u0022, \u0022event_fingerprint\u0022: \u00222a147a9adbce982f19169a016b32d1ebc13447e6\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00224f27c8ada3cf00810d415dcb33fbb0cd\u0022, \u0022path_pattern_hash\u0022: \u002296f1349e062970265d7d8e1816a851e1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/dashboard\/%2essh\/authorized_keys HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/dashboard\/%2essh\/authorized_keys\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/dashboard\/%2essh\/authorized_keys HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/dashboard\/%2essh\/authorized_keys HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: \u0022, \u0022payload_snippet\u0022: \u0022GET \/dashboard\/%2essh\/authorized_keys HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/dashboard\/%2essh\/authorized_keys\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/dashboard\/%2essh\/authorized_keys HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/dashboard\/%2essh\/authorized_keys HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: \u0022, \u0022payload_snippet\u0022: \u0022GET \/dashboard\/%2essh\/authorized_keys HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224e00fec42acae2cdaa90909064571b6ab7d7008e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/dashboard\/%2essh\/authorized_keys\u0022, \u0022request_line\u0022: \u0022GET \/dashboard\/%2essh\/authorized_keys HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/dashboard\/%2essh\/authorized_keys HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/dashboard\/%2essh\/authorized_keys\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/dashboard\/%2essh\/authorized_keys\u0022, \u0022request_line\u0022: \u0022GET \/dashboard\/%2essh\/authorized_keys HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/dashboard\/%2essh\/authorized_keys\u0022, \u0022evidence_snippet\u0022: \u0022GET \/dashboard\/%2essh\/authorized_keys HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_traefik\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_traefik\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":396},{"id":12605499,"ip":"35.152.246.200","ts":"2026-07-16 22:44:44.000000","proto":"tcp","src_port":13076,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/azure-credentials_sample","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002258aa084afe4a399c976fef0fa807ccb98951bbc2\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.168778834080074, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002244d14a95588d930efc47b50d1f18a43f88507c3f\u0022, \u0022event_fingerprint\u0022: \u0022c9890403c6833aa61b6402145aa67c47d2843e99\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00229c27e3ccd3dc1f11935216a99c8e17a2\u0022, \u0022path_pattern_hash\u0022: \u002207d8a3f81942e4ead684cb6e6595a85d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/azure-credentials_sample HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/azure-credentials_sample\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/azure-credentials_sample HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/azure-credentials_sample HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/azure-credentials_sample HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/azure-credentials_sample\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/azure-credentials_sample HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/azure-credentials_sample HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/azure-credentials_sample HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224662dca1ec8ab2719cd3de754571f9fd36af45a1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/azure-credentials_sample\u0022, \u0022request_line\u0022: \u0022GET \/azure-credentials_sample HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/azure-credentials_sample HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/azure-credentials_sample\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/azure-credentials_sample\u0022, \u0022request_line\u0022: \u0022GET \/azure-credentials_sample HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/azure-credentials_sample\u0022, \u0022evidence_snippet\u0022: \u0022GET \/azure-credentials_sample HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12605472,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12836,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/model\/config%2eyaml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002242bde782a8594d1cdf936be7b73d2f0848012457\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.204653798506846, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022fea641fd3fe0e497dbd307b9a3031ae816439854\u0022, \u0022event_fingerprint\u0022: \u0022fda54f69894bacd620b5f47423c04ea8a0cb1206\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00225065750bda67d8d06df6a93e15ea9294\u0022, \u0022path_pattern_hash\u0022: \u002295340356577891d3ebaf9968cbac462d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/api\/model\/config%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/model\/config%2eyaml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/model\/config%2eyaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/model\/config%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/model\/config%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/model\/config%2eyaml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/model\/config%2eyaml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/model\/config%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/model\/config%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222a0323e7fdf3912139c5c7006a4d1ea292af3679\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/model\/config%2eyaml\u0022, \u0022request_line\u0022: \u0022GET \/api\/model\/config%2eyaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/model\/config%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/model\/config%2eyaml\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/model\/config%2eyaml\u0022, \u0022request_line\u0022: \u0022GET \/api\/model\/config%2eyaml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/model\/config%2eyaml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/model\/config%2eyaml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12605473,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12840,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/s3\/config%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022dc901dcf925c84bcb409300516b0cfa9ca24c17a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 380, \u0022payload_entropy\u0022: 5.181326482356181, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b3e46f5cd37db6b8cb07e7b5fbd4ce667b525aa2\u0022, \u0022event_fingerprint\u0022: \u002245419068479af47de62e4915882aecce31d1cc3d\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00223271369e7d38511a9e3e978936721ffc\u0022, \u0022path_pattern_hash\u0022: \u0022c2f51d8bfc30f35ba9eae42a38437440\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/s3\/config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/s3\/config%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/s3\/config%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/s3\/config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-\u0022, \u0022payload_snippet\u0022: \u0022GET \/s3\/config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/s3\/config%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/s3\/config%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/s3\/config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-\u0022, \u0022payload_snippet\u0022: \u0022GET \/s3\/config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222bb692333308fc645cba3146ab11406f1a473c7d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/s3\/config%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/s3\/config%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/s3\/config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/s3\/config%2ejson\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab lfi-14 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/s3\/config%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/s3\/config%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/s3\/config%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/s3\/config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":380},{"id":12605474,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12856,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/json\/readme%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00226ca57485e074260622f17a5d18787eaedcfa247c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.210015522020351, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e040918b12c7e1dfab7f3ef2990eb6fa652e5236\u0022, \u0022event_fingerprint\u0022: \u0022c3690c076f98fdb66b20e4886db15b438431c05a\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c49c449886ad7dd274967f65bf3c64fa\u0022, \u0022path_pattern_hash\u0022: \u00227c2c048deaf700d4a12bd9e4dfd25b53\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/config\/json\/readme%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/json\/readme%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/json\/readme%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/json\/readme%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/json\/readme%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/json\/readme%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/json\/readme%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/json\/readme%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/json\/readme%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220e853d65e635a29f3a2523782850e31847d82783\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/json\/readme%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/json\/readme%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/json\/readme%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/json\/readme%2ebak\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/json\/readme%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/json\/readme%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/json\/readme%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/json\/readme%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12605475,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12862,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/server\/laravel\/docker-compose%2elocal%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022502e29086cda1b77f0eafcf91d1418d2f5f3d8e4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 407, \u0022payload_entropy\u0022: 5.216205025054591, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b23dffe6620e1fd57aaef0f050f48050f429d61d\u0022, \u0022event_fingerprint\u0022: \u0022ec4d3a58c870ae753ed6254d8e332144b4767c21\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002260b263656835a2cc853b58a048eae029\u0022, \u0022path_pattern_hash\u0022: \u002276d766cf441b8cb3879ba1bd2dad1ca8\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/server\/laravel\/docker-compose%2elocal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-En\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/server\/laravel\/docker-compose%2elocal%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2elocal%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/server\/laravel\/docker-compose%2elocal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-\u0022, \u0022payload_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2elocal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-En\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/server\/laravel\/docker-compose%2elocal%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2elocal%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/server\/laravel\/docker-compose%2elocal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-\u0022, \u0022payload_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2elocal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-En\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221b4eac6418d990ecf1e7c54d8574d02fcd21c074\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/server\/laravel\/docker-compose%2elocal%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2elocal%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2elocal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-En\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/server\/laravel\/docker-compose%2elocal%2eyml\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/server\/laravel\/docker-compose%2elocal%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/server\/laravel\/docker-compose%2elocal%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/server\/laravel\/docker-compose%2elocal%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/server\/laravel\/docker-compose%2elocal%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-En\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":407},{"id":12605476,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12868,"dst_port":6789,"service":"http","classification":"credential_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/certs\/id_rsa","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022323b31d35a13501ab78b589da453dc9007b79c0e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 376, \u0022payload_entropy\u0022: 5.1528540523680055, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00226bce643afdef0b195cb0e56ee722782a8a03534b\u0022, \u0022event_fingerprint\u0022: \u0022604081e5a1b6211333f3780a5791e6b5db802397\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 225, \u0022precision_signals\u0022: [\u0022SIGMA-web-credential-file\u0022, \u0022pat-0495\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022SIGMA-web-credential-file\u0022, \u0022pat-0495\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0495\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022Cred SSH private key id_rsa\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0495\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022lfi_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c5fc51ca29a0ab8d292f5a8da7c91be2\u0022, \u0022path_pattern_hash\u0022: \u0022f49e306a911c90f62d4ac0779528c2d1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/certs\/id_rsa HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: \u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/certs\/id_rsa\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/certs\/id_rsa HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/certs\/id_rsa HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/certs\/id_rsa HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/certs\/id_rsa\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/certs\/id_rsa HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/certs\/id_rsa HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/certs\/id_rsa HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022040d0f1d9f97467d70182909c800759949c4945a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/certs\/id_rsa\u0022, \u0022request_line\u0022: \u0022GET \/certs\/id_rsa HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/certs\/id_rsa HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022credential file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/certs\/id_rsa\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier credential\/cl\u00e9 \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022SIGMA-web-credential-file\u0022, \u0022pat-0495\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022SIGMA-web-credential-file\u0022, \u0022pat-0495\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/certs\/id_rsa\u0022, \u0022request_line\u0022: \u0022GET \/certs\/id_rsa HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022credential file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/certs\/id_rsa\u0022, \u0022evidence_snippet\u0022: \u0022GET \/certs\/id_rsa HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":376},{"id":12605477,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12872,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/downloads\/web%2econfig","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022a7fdefc1f5505774ef03495d666a88ecedac89c6\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.191535200582475, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00229fd99b5bf3d5cdcfcc235a48151b1ae6b0d5ceaa\u0022, \u0022event_fingerprint\u0022: \u0022ea4c81f916fb8152fa2c6dfa9cacba67ec479a18\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022f12b8d08c065a1afc30c6cc90e04c7cf\u0022, \u0022path_pattern_hash\u0022: \u002203b17beb886c1c0374432a876d940c9a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/downloads\/web%2econfig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/downloads\/web%2econfig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/downloads\/web%2econfig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/downloads\/web%2econfig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/downloads\/web%2econfig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/downloads\/web%2econfig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/downloads\/web%2econfig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/downloads\/web%2econfig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/downloads\/web%2econfig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220aff37809da34922055c25fc97184911df1f3905\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/downloads\/web%2econfig\u0022, \u0022request_line\u0022: \u0022GET \/downloads\/web%2econfig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/downloads\/web%2econfig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/downloads\/web%2econfig\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/downloads\/web%2econfig\u0022, \u0022request_line\u0022: \u0022GET \/downloads\/web%2econfig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/downloads\/web%2econfig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/downloads\/web%2econfig HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_downloads\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_downloads\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12605478,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12888,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/security\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022bdc4e4771da6d51049257f08a4188db46488867f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.16807626897086, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b043a210574bd3f5ec36b26621f5afd1038ef42f\u0022, \u0022event_fingerprint\u0022: \u0022add6d2618714ce61f5af0089f4ccb1d737f3cb9f\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002206c8f2d2b6310d447777d4518001ed68\u0022, \u0022path_pattern_hash\u0022: \u002282ba79396375204693cfef5f92e93dfb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/security\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/security\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/security\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/security\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/security\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/security\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/security\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/security\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/security\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d66fb85c1b20f7863a0e6bb1b31632c39b6a17c1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/security\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/security\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/security\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/security\/%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/security\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/security\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/security\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/security\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12605479,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12892,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/server\/src\/persistence\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 4, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u002253c4e589ac876cff6d34bb562d2c0db410bb5351\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 393, \u0022payload_entropy\u0022: 5.161391634877928, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b043a210574bd3f5ec36b26621f5afd1038ef42f\u0022, \u0022event_fingerprint\u0022: \u0022d3dda9f4c1fae83477bafc9df45a0c6121b1b6d5\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941150\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b072dc64c9e1b4e5a06c575bad48a9dd\u0022, \u0022path_pattern_hash\u0022: \u0022472a952a141f6d3248e80ae081a96ae8\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/server\/src\/persistence\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/server\/src\/persistence\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/server\/src\/persistence\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/server\/src\/persistence\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127\u0022, \u0022payload_snippet\u0022: \u0022GET \/server\/src\/persistence\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/server\/src\/persistence\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/server\/src\/persistence\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/server\/src\/persistence\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127\u0022, \u0022payload_snippet\u0022: \u0022GET \/server\/src\/persistence\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022480c4db1b3ec6e9644415de669cc11f19d60bd47\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/server\/src\/persistence\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/server\/src\/persistence\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/server\/src\/persistence\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/server\/src\/persistence\/%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/server\/src\/persistence\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/server\/src\/persistence\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/server\/src\/persistence\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/server\/src\/persistence\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":393},{"id":12605480,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12904,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/keys\/site%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00228b0abcb1caa0a9636073f3ddb1bf388dc1e410ae\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.181467964551952, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002277928053772017a4d4091922e871ed10b72e4939\u0022, \u0022event_fingerprint\u0022: \u002216c9699d47a198e1eb6c0985ec4976d8a0502fb3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002200ac514ecd20dc6d89294fac5dc422c9\u0022, \u0022path_pattern_hash\u0022: \u00228850451e92c470c1968b6f0925ae4490\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/api\/keys\/site%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/keys\/site%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/keys\/site%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/keys\/site%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/keys\/site%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/keys\/site%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/keys\/site%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/keys\/site%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/keys\/site%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b0dee58931af80c61193b727f5eaeaf8f1c330b0\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/keys\/site%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/api\/keys\/site%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/keys\/site%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/keys\/site%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/keys\/site%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/api\/keys\/site%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/keys\/site%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/keys\/site%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12605481,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12918,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/secrets\/sendgrid_api_key%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00221809e88a1240cfe25299cdc3db963e3ce19b6a13\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 394, \u0022payload_entropy\u0022: 5.203484165268703, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022dff9100c8da749dad9b0b65ceb7e3835d503aa4c\u0022, \u0022event_fingerprint\u0022: \u0022a6beff646262468933dbcfe059b2224e63ab4cb6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00221fbe6751fec58c85fa0eeffa61216ab6\u0022, \u0022path_pattern_hash\u0022: \u00229189440cda27b2427c4ba77ce4db5cab\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/secrets\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/secrets\/sendgrid_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/secrets\/sendgrid_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/secrets\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 12\u0022, \u0022payload_snippet\u0022: \u0022GET \/secrets\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/secrets\/sendgrid_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/secrets\/sendgrid_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/secrets\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 12\u0022, \u0022payload_snippet\u0022: \u0022GET \/secrets\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022537af5c5928eb5bb2d434a22530d2db3f945f556\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/secrets\/sendgrid_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/secrets\/sendgrid_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/secrets\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/secrets\/sendgrid_api_key%2etxt\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/secrets\/sendgrid_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/secrets\/sendgrid_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/secrets\/sendgrid_api_key%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/secrets\/sendgrid_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_secrets\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_secrets\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":394},{"id":12605482,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12920,"dst_port":6789,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/var\/task\/%2eaws\/credentials","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 4, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00224d42624307c3927bfd46e21576787f1c13e71a89\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 391, \u0022payload_entropy\u0022: 5.184857124451378, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 79, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022fd0aea7dbb8de3c64b8b302ba6c2aa712674d821\u0022, \u0022event_fingerprint\u0022: \u0022aa8bde6f119ef37954fd1d8b6d84bf80cc84aca2\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002283af8aa104427699ca3811a17104b95d\u0022, \u0022path_pattern_hash\u0022: \u0022776472550a6487dbf177271a863e87e1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 79}, \u0022payload_preview\u0022: \u0022GET \/var\/task\/%2eaws\/credentials HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/var\/task\/%2eaws\/credentials\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/var\/task\/%2eaws\/credentials HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/var\/task\/%2eaws\/credentials HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/var\/task\/%2eaws\/credentials HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/var\/task\/%2eaws\/credentials\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/var\/task\/%2eaws\/credentials HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/var\/task\/%2eaws\/credentials HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/var\/task\/%2eaws\/credentials HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002242d9d25e8aadf3d58d3c4561b5198e54916d654e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/var\/task\/%2eaws\/credentials\u0022, \u0022request_line\u0022: \u0022GET \/var\/task\/%2eaws\/credentials HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/var\/task\/%2eaws\/credentials HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/var\/task\/%2eaws\/credentials\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 79}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 79, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/var\/task\/%2eaws\/credentials\u0022, \u0022request_line\u0022: \u0022GET \/var\/task\/%2eaws\/credentials HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/var\/task\/%2eaws\/credentials\u0022, \u0022evidence_snippet\u0022: \u0022GET \/var\/task\/%2eaws\/credentials HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":391},{"id":12605483,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12934,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/css\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u00220cc76d17e6a718a4a3e1a3bd83ae15ed1b0f3836\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 374, \u0022payload_entropy\u0022: 5.158439788575982, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022b043a210574bd3f5ec36b26621f5afd1038ef42f\u0022, \u0022event_fingerprint\u0022: \u0022330027b805bf1a105daef30d4930c5d8c7f73619\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c540aed5bc1e3ffa8b35f65c378022dd\u0022, \u0022path_pattern_hash\u0022: \u00223f26918bb644f71dfb0d43f9e74f6c26\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/css\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/css\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/css\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/css\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/css\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/css\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/css\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/css\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/css\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022258cbe4ad4043dc6e7351559d8e64a77fced46ec\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/css\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/css\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/css\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/css\/%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/css\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/css\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/css\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/css\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":374},{"id":12605484,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12942,"dst_port":6789,"service":"http","classification":"credential_file_probe","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/token%2eini","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022e68bf680cf37bfd799a7f4f6c3745e92e4b8549e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.151956624006612, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 80, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022275b21c629b9fb497f079ccf8f67f6a04461aeff\u0022, \u0022event_fingerprint\u0022: \u002261210ed8b30e79c1cf0ddf598033e963a67f2b34\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab credential_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 160, \u0022precision_signals\u0022: [\u0022pat-0465\u0022, \u0022pat-0477\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0465\u0022, \u0022pat-0477\u0022], \u0022matched_patterns\u0022: [\u0022pat-0465\u0022, \u0022pat-0477\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022Cred API token endpoint\u0022, \u0022Cred Generic token path\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0465\u0022, \u0022pat-0477\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022lfi_attack\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e37b9ae00e742c7e73886f0d3900eb7b\u0022, \u0022path_pattern_hash\u0022: \u002222ec93eab4c1808f174a537c30feaab6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 80}, \u0022payload_preview\u0022: \u0022GET \/api\/token%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/token%2eini\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/token%2eini HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/token%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/token%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/token%2eini\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/token%2eini HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/token%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/token%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab credential_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221ced617afce494f3722427f508f3888d84428c4b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/token%2eini\u0022, \u0022request_line\u0022: \u0022GET \/api\/token%2eini HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/token%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022credential file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/token%2eini\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab credential_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab credential_file_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 80}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 80, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0465\u0022, \u0022pat-0477\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0465\u0022, \u0022pat-0477\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/token%2eini\u0022, \u0022request_line\u0022: \u0022GET \/api\/token%2eini HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022credential file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/token%2eini\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/token%2eini HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_oauth_probe\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_oauth_probe\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12605485,"ip":"35.152.246.200","ts":"2026-07-16 22:44:43.000000","proto":"tcp","src_port":12954,"dst_port":6789,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/test\/info%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u002280967ac44f88af291c041766827b51578c5fffdf\u0022, \u0022http_target_hash\u0022: \u0022cc94fe1672b9f83f25df55b130033afdf23aa27b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.1852413290350325, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 6789, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002257e446cb8d9e202607cd4c30bd1aa1331e1f1147\u0022, \u0022event_fingerprint\u0022: \u0022321a5ed5b3c1d0fa4cd5fdc007b936d2286ead83\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002259684c9730ec8dd07fe264a6d4856b88\u0022, \u0022path_pattern_hash\u0022: \u002273415ae28ab54c3cbdd1d5825e8d286d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/admin\/test\/info%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/test\/info%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/test\/info%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/test\/info%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/test\/info%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/test\/info%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/test\/info%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/test\/info%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/test\/info%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002240d9f03d3b10aecad43d76e17a2e7413e430d11d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/test\/info%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/test\/info%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/test\/info%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/test\/info%2eenv\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 6789, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/test\/info%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/test\/info%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 6789, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:6789 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/test\/info%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/test\/info%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:6789\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00226789 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226789\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:6789","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385}],"total_events":2793}