35.189.180.191

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.867161838618037,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "fd6e7555049932003dd0c677ac644bd9",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0017p\ufffd\ufffd\u04cbq=\ufffd\ufffd\ufffd\ufffd%,\ufffd\ufffd(\\\ufffd\u0016\u0002\u0002\u0014\ufffd=\u07c1\u0017N\ufffd \r\ufffd\ufffd\ufffdu\ufffd\ufffd\ufffd\u0013L\ufffd\ufffdw\ufffdI\ufffd\ufffd\"uUf8\u0003y\ufffd1~n\ufffd\ufffd\ufffdA\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "7bbff6208d56569aa1547a29d4cfbeb78340f81a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.875608335303372,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "75c02822c1ac44e3fb7186f8764414ea",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003|\ufffd\ufffd\u0015\ufffd\f\u0007\ufffd\ufffdo\rp\u0000\ufffd\ufffd\ufffdW\t\ufffd\u5cd7\ufffd\ufffd\ufffd\ufffd\ufffdSZ\u01ffJ j\ufffd\ufffd\ufffd\ufffd}\ufffd\ufffd\b\ufffdZ\ufffd\u029d\ufffd\ufffdn\ufffd\u0015\u0003*7\ufffdux\u001b\u0011\ufffd\\h\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "ccff47fb1a5e9b0b490ef82b0c79590851e77906",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.906618724184373,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "5417128b4cc8a0a90c4ffde72b53f94d",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003(!\ufffd\u8827O\ufffd\ufffd\ufffd\u0006\ufffd\u0005\ufffd\t\ufffd>}\ufffd\u001e+\ufffd\ufffd\ufffd\u06bf\ufffd\ufffd^\ufffd\ufffdu 4\ufffdv]\ufffd(\ufffd6}\ufffd\ufffd\ufffdP\u0004w\ufffd7\ufffdE\ufffd\ufc9f\ufffd[Z*\ufffd\u0011\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "98defb3b26f33db5efe7722572fe2195300dc15e",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.7120936708157775,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "784d5f6b67bf6fd60c62a6b255ab587a",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003+H\ufffd\u0015\ufffd\ufffd\ufffd\ufffdyo \ufffdY9\ufffd\ufffd\u000b\u0003\u0727j\ufffd\ufffd\ufffd\ufffd\u000279H\ufffd\ufffd \ufffdR\ufffd\ufffd\ufffd\ufffd=\ufffd\u44b7=},\u0019\u0003\ufffdZ\ufffd\"&\ufffdvr\ufffdA\u001d&oe\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "a6dd513d33f1f9ddde31c14343ad073c1cf6318a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.778203583199794,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "7e6aa6d6011dc89d4ca266641f558fb9",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0000\r\ufffdh[\ufffd\ufffd\ufffdh\u0000\ufffd\u0006\ufffdoQ6\u0017\ufffdx\ufffd\ufffd5\f\ufffd7f\ufffd>\ufffds\ufffd\ufffd ON7%\ufffdO\ufffd\ufffd\ufffd\ufffd\u0001\ufffdR\ufffd\uf647\u001b\ufffdn\ufffd\u001d\t\u0758\ufffdM\ufffdX\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "65b285075868fbc3a59303331a87b11f5fbcc203",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.847798550585441,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "0f8deafd73c90b0d0e67a43e6e16dabb",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdR\ufffd7\u0013cM(\ufffd\ufffd\u001a\u0016\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\u072f\ud129\ufffd\ufffd\ufffd\ufffd\ufffdL\u001fD {\ufffd\ufffd\ufffd\ufffd\ufffd:>\/k\u0708\b=\u0011\ufffd\u0017fW\ufffd\ufffd}\ufffd\ufffd+\u0019\ufffd\ufffd\ufffd\u001f;\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "ce7ec3357d6f0c0e8921cc9f3caee33e4ff726e8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.843447771820628,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "ef5ef756ca9917cd8fe5247837a891b0",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0018;{A2!J\ufffdH<\u0013Ctq\ufffd\ufffdr\ufffd#\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\u0003\ufffd\ufffd\ufffd \ufffd\ufffd\u02ef\ufffdC\ufffd\u0006\ufffdR^\ufffd\ufffd\ufffd\ufffd\u0017\\?\ufffdv\\\ufffdy\ufffdf\ufffd0T\ufffdY\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "eeb2e3bb02bf47bc0a26e1d24f8d4dcc5d3cc24c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.90347592914266,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "53315c547ab0c0c1fcacce5582422a44",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003U\ufffd\"*\u0012\ufffd\ufffd\u0396b<\ufffd%\u0015\ufffd,Lm\ufffd1M%\ufffd(Y\u0016\u0002\ufffd_;\u0019 \ufffdR\ufffdc\ufffdD\ufffd4\u000f$\ufffd\ufffdD\ufffd\ufffd@\ufffdL\ufffdR\ufffd\ufffd\ufffd\ufffd\u04a2\ufffd\ufffd1\ufffd\ufffdE\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "b5a57c7266b5cbc2777f88812c790b87071163b5",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.821380430248526,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "55474f2a1a69ffddf68ad54dd5823e1e",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdxO8\u0010\ufffd\r\ufffdD\ufffd|\u0000q\ufffdH7[I\ufffdd\u0016]\u026b\ufffd\ufffd\u0004]\u0003U\ufffd\u0002 \u001aF|*\u01ce\ufffd7\ufffd\ufffd\ufffd\ufffd]\u000f\ufffdD,6:q\u001f\ufffd\u00114)7s\ufffd\ufffd\ufffdW\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "fd45a7eb9915a3480df3874811e847389834849b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.910725457246082,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "6ac3fb7ed8c490886ee5c5c773bcc0a5",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Am\u0015tX\u0763\ufffd\ufffdH\ufffd_\ufffd\u0013C5\ufffd\u0439!\u001e\ufffd\ufffd\ufffd\ufffd\f\ufffdg#\ufffd\ufffd\ufffd M6\u0011\u0012~Qx\ufffdw\fnyN$\u0001cP\u0015\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001aK\ufffdx\u00d3\u056f\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "15748d4eee652dde5464d6ac3073bedb825c935b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.933803389756758,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "59ad3998fe6b16ef8a3a947b0337f19e",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u000326\\\ufffdY\ufffd\ufffd=\ufffd-e\ufffdOZi\ufffd\ufffdW\ufffd\ufffd\ufffd\u05df\ufffd]7X\u0002\ufffdw\ufffd \u05b57\"\ufffd\ufffd\ufffd\ufffdu\u001c\ufffdb\u000e\ufffd\ufffdcE\/+\ufffd\ufffd\u0132~\ufffdD\ufffdJ\u001d\ufffdj\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "ad006c6e8bc66d54ddc7d6bafcd82b3965124094",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.849299291635132,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "d8ec6f69e363a6bdd7069f64dc6ff9e8",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdf\ufffdHL\u000fW\ufffd\ufffd\ufffd\u0015\ufffdeB\ufffdw\ufffd\u001d\ufffdE\u0019\ufffd3\u001a\ufffdq\u0018\u001e\u0017\u0610 M=\ufffdU\u03e7\ufffd\u0015+\u0004T4\ufffd\u001b\ufffd(\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd}\ufffd\ufffd\ufffds\ufffdQ\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "845c66204580e9cbd5fb1d4282d1173621a89e11",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.888339219323566,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "a4bf0394ad66e26a90ee05094db9911f",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003VO4C\ufffd\ufffd\"{[\ufffd\ufffd-\ufffdo\ufffdd\ufffd\ufffd\ufffd\ufffd\r\ufffd\ufffd\ufffd\ufffd\u0017!\t\ufffd\ufffdU\ufffd \ufffdG8_W\u0003E\ufffdC\ufffduW\ufffd\u0466cc\ufffd\ufffd\ufffd\ufffdv@\ufffd0\ufffd\ufffdw\ufffde\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "5e0e3297e0ffa2f22a354e531975193ab2cacdb3",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.908984071997019,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "da12258a034718374fd283b98bf7609e",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003]\ufffd\ufffd'M\ufffd\ufffd\ufffd\u62f6\ufffd1M\f\ufffd\ufffd\ufffd\tW\u0004\u042e\ufffdM\u0649u\u000b\ufffd\u0019S \ufffdx\u001b-\u0018TH\ufffd\ufffd\ufffdX\ufffd\ufffd;\ufffd\ufffd\u0018\ufffd\ufffd\u0001h\ufffd;\ufffd\ufffd\ufffdP9\ufffd\ufffd?\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "ddfa09524834aa7fd1bf5a5ca89e4250e20f45ed",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.803288988612751,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "58b8fa25f09d1fdbfdecea856e4c15d5",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00033\ufffd\ufffdBF\ufffd\ufffd>l\ufffd\u001b\ufffdN[\ufffdP\ufffd\u00065-\ufffd@\ufffd\u0011de\ufffd B\ufffd\ufffd\r \ufffdd\ufffd\ufffd\ufffd>\ufffd\ufffd86\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd\u0005#\ufffd\ufffdO\ufffd\ufffde\u001f\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "fc0e419a9a5584f48526b19b41ea8f4a53130c94",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.831087475101427,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "8f7aefe5653a9ff86d8acbf706abb2f2",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0001\ufffd\ufffd\"b\ufffdA\ufffd\u001cDo;M\u000f\ufffd6\ufffd\ufffd\u0018\ufffd\b3\ufffd\ufffd\ufffd\"m\ufffd \\x\ufffdu\u0005M\ufffd\t\ufffd.\ufffd\ufffdS\u0018\u0604\u0003\ufffdz\ufffdw\ufffd\u0010`\ufffd\ufffd\ufffd\ufffd,F\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "fa28bf2f24a75328820bb87b9607bf71e2cebea0",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.815319330142877,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "94c3bddc95c6e246bd0203e87ffa5620",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0005^\ufffd\u00d8+\u0012\ufffd\u001d\ufffd\ufffdQ(!\ufffd\ufffd\u0014\ufffd(Y\ufffd\u000f\u001ck\ufffd\ufffd^^ \ufffd\u028d\ufffd%]\u0003\t\ufffd\ufffdc\u0014\u0016\ufffd\ufffd\ufffdZ\u001am\ufffdp%0}(M\ufffd!\ufffdv\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "4f197421a3b103b835a20a1a275ad71ebfb13e40",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.830299040645164,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "fc225814d2cf3ee6a15459d22d374f17",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001e\u0013\ufffd\u025f\ufffd_o\ufffd\u000f\u04ab1\u0007\ufffd_\ufffd \u0014\u0015\ufffdP\ufffd\u0000\ufffd0\ufffd\ufffd\u030f\ufffdA \ufffd\ufffd\ufffd[`\ufffd\ufffd(\u0017\u0002 \"gm\ufffd\ufffd3\ufffdWI\ufffd\ufffd\u001e\u0003\ufffd\u0015!Q\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "3c7bdeb68f9a1fa22b880ca360a1181e0d47210a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.842515293944514,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "6c3086f3f9978ca3c4f10fdae24b18f9",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Ll\u05fd\ufffd[\u0003\u001c \ufffdi\u0016\ufffdB]\ufffd\ufffd;\ufffd\tg\ufffd\r\u001c\ufffd\ufffdx\u001d\ufffdMq\ufffd 0.\u000f?\u03a8\ufffd\ufffdV\ufffd^\ufffdXH\u04d0\ufffd\ufffd\u027f\n\ufffd\ufffdz\ufffd?_\ufffd,\ufffd\ufffdz\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "4fd652d7890872a2067bd7bdb154852ee26c160a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.940956134294613,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "779dbaa7686f84151edfe214acf7616f",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0014+\ufffd\ufffd\ufffd\ufffd;\t\ufffd|\ufffd\ufffd\ufffd\ufffd\ufffdZ@\ufffdm\ufffd(\ufffd\ufffd\ufffd\ufffdg4\ufffd N\ufffd\u0010KEfB|[\ufffd\ufffd WD\u0157\ufffd\\\u0780N2\ufffd--\ufffd\ufffd\b`n\\\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "af9fe2985cc75865fa511903620c63abef715019",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.831062148911805,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "89526723de8718efa1dbf6faafb15360",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdH@g\ufffd*T!.\u00192GP\ufffd\u0013C4\u01b3q\u0012\ufffdB\ufffd\ufffd\ufffd\ufffdG\u000b\u001bj\ufffd ]\ufffd\/.\ufffd\ufffd9xk\ufffdO3\ufffd$\u0497\ufffd\ufffd\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\ufffd\ufffd\u001cD5\ufffd8\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "1c203088fe0c43be5fdcd077847a1bfcb869beb6",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.829790993222826,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "6b5b6b5ea4348336e883fdb22b09a937",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\t3J.\u0017:\ufffd\ufffd)\ufffdYK0\u001b\ufffdP\ufffd$),\ufffdB0\ufffd\u0002X%\ufffdAJ8\ufffd #\u01d8Y\ufffdV\u0002\ufffd\ufffd\ufffdD\ufffd\ufffd{{}\u001e\ufffd\u000e\u0004+y\ufffd\u001f\ufffd\u001f\ufffd\u0007\ufffd@<\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "59851e625ffff83c556a242ca955227169e84204",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.811549107654747,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "d13a0c8fc60f61de30ea19a462fb28d4",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003~ \ufffdw\ufffd#\u0014r\u0014\ufffd\u0005\ufffdz!\ufffd\"w\u0014\ufffd\ufffd{?\ufffd\ufffd\ufffd\u008b\u0006 b N\ufffd\ufffd\u0001\ufffdUo8Q\ufffd\ufffd\ufffdAuS\ufffd#7\ufffd\u0019\ufffd\ufffd\ufffdK\ufffd\ufffd\u0583\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "1c746d39c913d1bf3b77c51ec5c6667c6c60886b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8042616771705315,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "12caec7c23fd002a7b300e23da5d6053",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00032s\ufffd5C\ufffd\u0010\ufffd\ufffd\u0001\ufffd\ufffdO\ufffdc\ufffd2\ufffd\ufffdb\u0007\ufffdKm\u0010q\ufffd\ufffd\ufffd\ufffd \ufffd\u0010'\ufffd\r;0v\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL\ufffd+\ufffd\u07a6^\ufffdI\u000bX+\u0014\ufffd\"a\n\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "2d12cd1b926acd3441fee659e503382d71f1eb16",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.780843228535975,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "8e5753fa802432629b17db57403a958e",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003Wb\b\ufffd\ufffd\u0002\u0012\ufffdH\u0019\ufffd$\ufffd\u0760{\ufffd\ufffd\ufffd\ufffd=\ufffd\u0007,>\ufffd\ufffdQ\u0000&\ufffdY %a\ufffd\ufffd\ufffd\ufffdK\ufffd\u0011\ufffdum\ufffdR+\ufffd\u001a\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdm\ufffd>\ufffdT*\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "e09e228f39183efcf643c67893be4e01b4bbb750",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.9235302052720975,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "e317d3bb518e1d486e1cdd6867a1b03e",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0690\ufffd\ufffd~\ufffd\ufffd\u014d\\3\ufffd\ufffd\\\ufffdr~\ufffdIV\ufffd\ufffd\ufffdW\ufffd\u0002S\ufffd\ufffdA\ufffd \ufffd\ufffd\u0002Uk\ufffdlla\ufffd\ufffd]\u0346Ui_\ufffdU8\ufffd\u001e>\ufffdS\ufffd\ufffdNr\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "e10a035c17e9fd28c0ceae1feeb00c33ff65c694",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.81117852035376,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "71d51f6e116f343b329b0e8f1034f7c4",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00030\ufffdT\ufffd\ufffd\ufffd~2\ufffd^\ufffd\ufffd\ufffd\ufffdG_\ufffd\ufffdo5\ufffd\u000f\ufffdo\/\u00f1\u0011\ufffd\ufffd Z\ufffd\ufffd]M\u0012\ufffd\ufffd\"\ufffd\r9\u0016\ufffd\ufffd\ufffd\ufffd\ufffd}0\ufffd6\ufffd\ufffd\u0018\ufffd\u0006\ufffd\u0011z\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "8f6c0c0f25cf3f3de0268cfbb68b4892929ee57d",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.801763766953334,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "b0baeb71603a090ed361585c810f2cbd",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0002\ufffd\ufffd\ufffdB6O\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdO\u0014| \ufffd\u0792c\ufffd\u0018\ufffd\ufffdb\ufffd\ufffd\u001d8\ufffd\ufffd \ufffd6\ufffdw\ufffd1\ufffd\ufffd&v\u0633\u06f2\u0007\t\ufffdh\ufffd\ufffd\ufffdr\ufffd\u000b-\ufffd\ufffd\ufffd\ufffdW\u0001@\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "ee0e5cbe1b645a89ddb790d45eb0531360c0a768",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.791193816702647,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "001655dfd238388b4792c8795a13eeeb",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd{jj07\u0017\ufffd\ufffdVN\ufffdW\ufffdT\ufffd\ufffdv\ufffd\ufffdx<\ufffd\ufffd\ufffd\ufffdw\u0016q\ufffd\ufffd9 \ufffd|\u001ae\u02b9K\ufffdx\ufffd\ufffd\ufffd3S$\ufffd\ufffd\u0015_\u0004\ufffd\ufffd_\ufffd\ufffd\b,\ufffdcF\u0018\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "cb272c6238d326f80b86a7ebc9f3097ee93768ca",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.871807076821014,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "7de25a73d09bdfe6b94b59b77cecb8ab",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003v\ufffd,\ufffd\u063bX\ufffd,\ufffdFB\ufffd\ufffd\u0638\ufffd\u059d,\ufffd\b#\u0017\r\ufffd\ufffd\ufffd\ufffd\ufffdNP \ufffd\ufffd\ufffd\uc7ea\u0017\u001cD\ufffd\u0482h\ufffd&\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffdW^\ufffd7j\ufffd\ufffd\u001d\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "a76a824ff5cd30f234de474280fa1f3e1d29e24d",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.85950675646245,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "6eaa21a6c5376ce413172249b5c07af8",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffdz\b`8!~0\ufffd\ufffd\ufffd\ufffd\u0239F\u000f\ufffd$\r\ufffd\b\rn\ufffd\ufffd\u0012p\ufffd \ufffdB\fN\ufffd\ufffdf'\ufffdhK\u001e\ufffd\ufffds\u001fp\u0015\u0012\ufffd\ufffd\ufffd\ufffd\ufffdl\u000e}\u0007\u001f\ufffdeD\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "3eac99c273aee14c413f72565c4aecf06bd383b2",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.75977706168168,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "49540c9e755c8e5662a8d69db90b366c",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdS\ufffd?K\ufffd?\ufffd!\ufffd\ufffd\u0000\ufffdV\ufffd]\ufffd\ufffd\ufffd0\ufffd\ufffd\ufffd!5(\ufffd\u0261\ufffd\u001f\ufffd \ufffd\ufffdK\ufffd9U\ufffd\u0013\ufffd(\ufffdl\ufffd\ufffd b\ufffd\u026dh\ufffd8\ufffd\u0003\u001c\u0017\ufffd:\ufffd\ufffdj\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "267f380aff67e1cf5b5f6f44adb755445102cdfd",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.74564452650524,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "dfa0ccdbf5ecf5eab3f363fb4f2527ec",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd;j\ufffdnb\u0003\u0004N\ufffd\ufffd\ufffd=\u0005\ufffd\u000f`\ufffd\u001ca\ufffdA\u0018\u0018-\ufffdkt\u032eM\ufffd \u0002\ufffd{\ufffdf{\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\u0014h\ufffdi\u0010\ufffd;m\ufffd\u001f\ufffd\ufffd\u0005\ufffd\u012e\u000ez\ufffdZ\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "9e6cadf6896110f4365d85c67c7466eda5e1f790",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.836343944804762,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "da7d66379f742cd2ccea66b106177b26",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003%\u0006\ufffdaMn\u057e\ufffd9\ufffd\ufffdl\u000e\ufffdF\ufffd\ufffd\ufffd\ufffd\u0019\ufffd\ufffd;sQ\ufffd'\ufffd\ufffd\u0005\u0014 k\ufffdP\ufffd\ufffd\ufffd\u001a\ufffd\u000e\ufffd\t\f\u05cf\ufffd^i9`\ufffd\ufffd\u0007\ufffd\ufffd\u0566\ufffd\ufffd\\?\ufffde\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "d804ae5cd36a423bafce09af3941e47ac72cc1f7",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.870234595307311,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "8f416347004407cabf9c7fe5a695a904",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003F\u001d\u0018\ufffd,\ufffd\u0004q\ufffd}\ufffd\ufffd#r\ufffdU\ufffd2e\u0005-\ufffd\ufffd^\ufffdc\ufffd\ufffd|\u000e\u001e \ufffd\ufffdn~\\\ufffdy'W)\ufffd\ufffd&\ufffd\ufffdZ\ufffd6\u00a9f\ufffd\u0002p\u0002:\ufffdW\"\ufffdK\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "f3b5f8e87f2880263634ac8d7bcf255e385e7d02",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.853843920619152,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "66552726b2cf6f5803ac8005d56469af",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000f\ufffdr4\ufffd\u01b7\ufffd>\ufffdYm\ufffdH\u000fl\b\ufffdw=Eq\u0007#\u0019r\u0013#\ufffdZ\ufffd\u0015 \ufffd\ufffd0\ufffd_n8\ufffd\ufffd\u001b.\u0006\u00f8\ufffd\u06d4J\ufffd\ub072\u000fFbo^\ufffdR!\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "fe847474c4ae5f88ded1fc5786ccf411a5b976d9",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.922276663806283,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "609ca80a5c608355fc8ca4f5f3d1eafb",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003T\ufffdm\ufffd*O\ufffdxwd|\ufffdI\u0011(\ufffd3|\ufffd\ufffdZ@\ufffdP3\ufffdlM\ufffd\u0013\ufffd1 2\ufffdg\u0014\ufffdD$\u000b\ufffd;\ufffd\ufffdp\/\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\u05cf\ufffdN\ufffd\ufffd\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "0a97eb8803e349fdef51798f6702760b5dbad565",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.88457604600805,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "8a73e79271b1a05c0461d25724ddb175",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd]Y\ufffd\ufffd\t\ufffdp\ufffd}\u000fr\u0004\u0002X\b\ufffd1\ufffd\u076c\rz\ufffd\ufffd\u000b\ufffdp\ufffd x Ri\u0019\ufffd\ufffd~\ufffdi\u0013Lc\ufffd\ufffd\ufffd\u001aDU\ufffd\u001c\ufffdW\u06ca\ufffd^&\ufffd\ufffd_b\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "37560d0b0908e54fe3918eefaf25c634121ff909",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.849396358288766,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "a43abfc304a85e561bc6b8e6b15b0176",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdZ\ufffd;\ufffd\ufffd\ufffd\u0003}v\ufffd\ufffd\ufffd\f\ufffd3\ufffd\ufffd\u000e\u00004\u000f\ufffd\ufffd\u04f3<:\ufffd,\ufffdr ~x\ufffd\ufffd\ufffd;G^\ufffdpu:\ufffd%w\ufffd\ufffd\ufffdj\ufffd\ufffd3\ufffdm\ufffd\u017fOj\ufffdD\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "3ba85eb90a498666e61b0101e180f9578470d544",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8431261020416265,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "6a6ec6a7d028a157099f353496109ffa",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u001a\ufffd\u00000\ufffd\ufffdR\ufffd5ya\ufffd\u0016\ufffd\ufffd\ufffdF\u001d`e\ufffd\ufffd\t\b\ufffdb\ufffd\ufffdBd\ufffd\ufffd \ufffd5>\ufffd\ufffd{\ufffd\ufffd\ufffdG\u2aee\ufffd\ufffd\ufffdH\ufffdLz\ufffd\ufffd\u0002\ufffd\u001a\ufffd$\b\nA\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "9b32cdc91ec018065f43109d4ca79731c05a582d",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.7754183819542835,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "95c2e58ca51d5ef2caad9e815c7297f7",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003W\ufffd\u0013\ufffd\ufffd$\ufffd\ufffd\u001a\ufffdE\ufffd*\u0016\ufffd\ufffd?_B\ufffd\ufffd\u00d6\ufffd\ufffd\u0678\u001fn\ufffd&| \ufffd\u06ea\ufffd\u000e?\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdUEk\u0017ru\ufffds\ufffd\t\t\u0004\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "bb818d2fbb8db4e4b292b32ce48e05e9372b7274",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.809734324273975,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "092f164a4d826330c4f24c481904453e",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffdW\ufffd\u001e\bW\ufffd\ufffd\ufffd\b4\ufffd\ufffd\ufa90I\u0015n3d\ufffd5\t\ufffd;\ufffdO^\ufffd\u00e1 \"\ufffd3\ufffd\ufffdi\ufffd\ufffd\u0003\u001d\ufffd['\b\ufffdYN\ufffd5T\f\u000b\ufffd\ufffdG\ufffd!\ufffd\u0011\ufffd\ufffd\u0006\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "e15a4ab097f431459db225375f11ea14441e23f4",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.835915265294354,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "f701146492fae83058cec8b95bd7cba3",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00037\ufffd]\ufffd\u001e\uda7d\ude8f-\u0002\u000e\u0156\u07c7F\ufffdj\f\ufffd\ufffd@\ufffd3\ufffd\ufffdW$\ufffd\ufffd \ufffd\ufffdwa<\ufffd\u0016\ufffdA\ufffd\ufffd^`\u001fls\ufffda\u001f\u0013\u0012\ufffd\ufffd\ufffd&\"&J]q\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "e5a451d5bafd0f1b6a0d63f0c3fa3b934de0ed77",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.971959939877108,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "c718a54b6729a2118491dc50c75e744f",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0011\ufffdi\ufffd\ufffd\ufffd5\ufffdFGo\ufffdx\u043d\ufffd\ufffd\ts\ufffdp\u01e7:\ufffd\r\ufffdYk( \ufffdkQ\ufffd\u5049\ufffd\u0360md\u0015\ufffd\ufffd\ufffd\ufffd]\ufffd.\ufffdE\ufffd*v\ufffd\u0081\ufffd\ufffdr\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "a77b9cc278442cd271196269cc6e9d9a3d54c96a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8167947450029445,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "16efe3ee531e8e680a55f056e3e07e19",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u00036\ufffd\ufffd7X2\ufffd\ufffd\ufffdT'\u00028x\"a\ufffd\u0002\u0015+\b\ufffd)HO\ufffd$v\u0019&G\ufffd \ufffd\u0003\ufffdPC\u0288\u000e\u0104rm\u001a*\ufffd\u0013\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\u5f40\ufffd_\u0006m\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "9a2efb00855847aec40909f773bac07c73881204",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.834196193415732,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "992b1bbbf6e98202c355225806023b36",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u000fV\ufffd.\"\ufffd\ufffd\u0001K\ufffdF\ufffd\ufffd\u0014\ufffd\ufffdP\ufffdw2\u0016\u0004\ufffd\ufffd\ufffd\u0012^Hyr\t\ufffd tc\ufffd\ufffd>\ufffd\u03c2\u0464!W\ufffd\ufffd\u001aw \ufffd\ufffd\ufffdh=4\ufffd\ufffdo\ufffd<\u012f\ufffds\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "fab80429f115ca109d9318a98d189ca17e757d54",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8996410590606025,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "449b739d388a4bbd54d70ae767e73191",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd3\ufffd\ufffdD;e\ufffdC\ufffdI.\ufffd\\\u0013M_\\\u001c\ufffd\u0014\ufffd\ufffds\ufffd{8)\ufffd \u0016IP\u001f\ufffd$\ufffdyhn\ufffd\ufffd\ufffd#\u00cc\u0011\u076c\ufffd\ufffd\ufffd\u0002=^\ufffd\u0011|h\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "ba0fc3ec1a71718585f7a3722eacb23d659fa137",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.866392252649389,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "8690d6e594418fe8a057374b9fc37745",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003z\ufffd\ufffd\ufffd\ufffd\u001a\ufffd\ufffd\ufffdG\f}\ufffd\ufffd6V\ufffd\ufffd\u03b3\ufffd\u06a1\ufffd\ufffd\ufffd\ufffd\ufffdP\ufffd>H >\ufffd=\ufffd\u0674~\uce57\u0007\ufffd\ufffdB\ufffd;s!\ufffd\ufffd\u001e\u0019|\ufffd\ufffd;\u0014'4|Q\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "5fbb2aa49053bc3496dbdbe9c45ff6fa4a1e12ea",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.817974705550995,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "3b8ebe70f911c6dd5d0c67316a519f8f",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd(\u02dd\ufffd\ufffd\ufffd\ufffd\ufffd\u056a\ufffd#\ufffd1]3\ufffd\ufffd@W\u001d\ufffdj\ufffd\u0014\ufffd 4\ufffd\ufffdFK\ufffd:\\\ufffd\u0012\ufffdU\ufffd\ufffdT\ufffd\\o\ufffd-\ufffd\ufffd\ufffd\bXr\ufffd\u0003\ufffd\u001aW\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "38f24ffb52779a087491cc5356dee1f3584a2839",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.811378460083349,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 8091,
    "risk_waf": 8,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 30,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "6d3768f3f6d91b623dfa7196fda17d1200491f65",
    "event_fingerprint": "7fe7ee03db3da4542299c53670ccd563b3456b4c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "b1af6cab8e5c254b5e6db7f91430bc00",
        "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
    },
    "target_context": {
        "dst_port": 8091,
        "service": "tls"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u05b0\ufffdY\ufffd@\u0544\ufffd[G\ufffdOd\ufffd\ufffd\u0010\ufffduQb\ufffd\ufffdg\u0003A \u001b\ufffd\u0004\u0003 \ufffdV7\ufffd}T\ufffd{D\ufffd\ufffd\ufffd\ufffd\u0004Hd)b\ufffd>A\ufffd-\u0010\ufffd\ufffd\u0006\u0015g\ufffd8\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "d3b0bf67d158797f516b968ba4c2d1cc0e25b15d",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}