35.221.148.26

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "5ba85bf1adab7e8c6adde4b14977d46b3ed3e85b",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "194ffa296bf5bf546445bc77a4914a3c16983759",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 177,
    "payload_entropy": 5.168530763201073,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "0a2cc1c98498efeaaeb048360c88223d3be236fe",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "2680343390e751f609a63266617e2356",
        "payload_hash": "e17836494221c22d91cb7935bdedd266",
        "path_pattern_hash": "162fef3d3c20397fd9e19a55bcddfa03"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/application.log HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/2.0 (compatible; Ask Jeeves\/Teoma)\r\nAccept-Charset: ut",
    "event_signature": "f029b0f5d6750ada49af78dc672575fd7c088a14",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "fa04af9816f0793fdc1a867eef08c9bba4602d70",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "63438c908367e4f8041717ab279c4d967e15af99",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 216,
    "payload_entropy": 5.262683872206462,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "14b24df62c195e71dd7a49da85ee1b219a4539ae",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "019e2e1e34358ddde0b0e9ce516b2815",
        "payload_hash": "099e8b81e1ff5d5620bf8c8052c3604e",
        "path_pattern_hash": "3185fcf0045ab357f9b5c65f6fd9ad4d"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/access.log HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686; rv:10.0.1) Gecko\/20100101 Firefox\/10.",
    "event_signature": "2a1fe93e2ad5df0a9b58888b8a7866011fc91f83",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "log",
    "http_ua_hash": "228093dfc8613d5849462c5a76e09e1ed546d775",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "03e204e4d1092f0f3982669317d2eb101a33266b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 269,
    "payload_entropy": 5.467489262894736,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 62,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "b46bcb19a578952037df384b8a05c45a89364d6d",
    "event_fingerprint": "d741ca596f97b26c7ff2d516828ac03825a2edf7",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "2672f4668bf1c319d541ae1310315577",
        "payload_hash": "7fbc5f67fa589f85c60d35703db5de79",
        "path_pattern_hash": "2521db54cde5bdc17cc591777e55b15e"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/logs\/debug.log HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.0; LGUS997 Build\/NRD90U) AppleWeb",
    "event_signature": "b95f514193888a3968ccef56aadce4354f2781a3",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_logs",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "16e5468845978643acb5fb6b1c57694008e29cc0",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "437770240dcc724c5033b3c158c576b84dde4de1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 194,
    "payload_entropy": 5.236780383245455,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "631112fa5a7c0a084a15662a37562b324c37b11d",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "51f51d4b872834d223ccfb12694b180b",
        "payload_hash": "8d8bcf8d8de97a8fc9f5821ab547e686",
        "path_pattern_hash": "1bb66c038c973622f0056a763496f9ef"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/server.log HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Opera\/9.80 (Windows NT 6.1; WOW64) Presto\/2.12.388 Version\/12.16\r\nA",
    "event_signature": "9c1689182ac7413447a1f3c8fe8dc42e4c32a708",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "log",
    "http_ua_hash": "ca35d74e05796f7988a94ed1338cd6588e2cb254",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "0306f640cbfe7832e364cfa8aaa4495e8ef14f08",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 282,
    "payload_entropy": 5.4272912344467965,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "d71b635920e335697332fcc8a8ca8b0de4f638c8",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "8ba5c6515cf00a95c13450ef1541a010",
        "payload_hash": "8f41b58377f0c67b21a16278a334a3f8",
        "path_pattern_hash": "f8d80e9ce78cc8d6e0404ba95f5bd5a6"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/trace.log HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; moto e5 cruise Build\/OCPS27.91-15",
    "event_signature": "e9f7ddb9f3cf75e72cbf35d4c59157733e4de3a3",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "log",
    "http_ua_hash": "10b0d842caaedd8324f537849b7a09eb1a2c0a1e",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "9d5f558e73ca716aa21e27c6081370ba7dda563b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 269,
    "payload_entropy": 5.400580517487546,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "93de5eeefffc812f5144483aebebfd0812ba0624",
    "event_fingerprint": "739d216efe1b0fbdf62035dd158112ec9e24862c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "04b187a7437a9377bf5abbeaf7da2d2e",
        "payload_hash": "d867a5c8ae2287bef867e35d39d7fefc",
        "path_pattern_hash": "11a7dc2316512e9b8311ac327e383bb9"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/logs\/error.log HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (X11; Linux i686) AppleWebKit\/535.2 (KHTML, like Ge",
    "event_signature": "8a5b5a79f8657bb0276da5a89dc529640c63e4a7",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_logs",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "log",
    "http_ua_hash": "a02c0f8b84ba7493f7f8f97d10eb0c0de20724dc",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "cdf00c17308c69bcbf2914393a08738de75ce806",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 280,
    "payload_entropy": 5.403344129104581,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "93de5eeefffc812f5144483aebebfd0812ba0624",
    "event_fingerprint": "e7ab64c70f2fa12b276ae98b11f56e08c14d7609",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "5ad202994ca4cdcc7e2c2766b8644362",
        "payload_hash": "5ecc002a393174f6f09c072be84f8ef0",
        "path_pattern_hash": "60fc95e5699c71a682d502bba60586d5"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/logs\/application.log HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64) AppleWebKit\/537.36 (K",
    "event_signature": "2fe13c68ad4f1f1b50c728c9af6ee382d2947c48",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_logs",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "log",
    "http_ua_hash": "3f29025821b3a94eaa79a10f577739f1a7d267f6",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "3fb5b472f52b8bcac2f6138463cf27ff65b8c633",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 236,
    "payload_entropy": 5.333684187251466,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 56,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 56,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "4a996fb5a0c5cd1dcf72ba05507cd18a134a8afd",
    "event_fingerprint": "8676929149c814f11321aa6c13be708896df488a",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "8189347f53da54fe3964a69ee13bbe99",
        "payload_hash": "43e8d8a411a4059d7fb709cac1236dca",
        "path_pattern_hash": "0a13815894d10bbcd047ea689c56dc08"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "web_injection"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/log\/debug.log HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: SonyEricssonZ800\/R1Y Browser\/SEMC-Browser\/4.1 Profile\/MIDP-2.0 C",
    "event_signature": "5455ae9e6a29658cb0874af2ca746a0f736b6a08",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_log",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "log",
    "http_ua_hash": "e81cb2b116e29ca54679925c8da33c49517289d8",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "d0b8b644029ba159087a417f2e8eafdc14fc0ddb",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 249,
    "payload_entropy": 5.360151442797358,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "93de5eeefffc812f5144483aebebfd0812ba0624",
    "event_fingerprint": "6bf3a29f02e43a976535bbab9842e9756cb1d7be",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "f5545d5f862395075c89ff9c024d9755",
        "payload_hash": "91c02270616d4041d44842996168f958",
        "path_pattern_hash": "1ee40b92eb3b65f75911cb662d7e1127"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/logs\/app.log HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/605.1",
    "event_signature": "cc354fe696328bf81d9465e8925c00c3217d20fb",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_logs",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "htpasswd",
    "http_ua_hash": "a7105aaaf98fe6da91c9abe21402f0bad7abbf3d",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "ade2de8d21551efb00f221b43821b4acb26b6f79",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 257,
    "payload_entropy": 5.413797384042459,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 92,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 92,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 64,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "5cdc56e555ddc5a392889a01c45ed298b64074b9",
    "event_fingerprint": "09e1c752e8e862bdb9846ffaf0433387fbebed10",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c3ad43cf0b9fc735bad09bffdf4e8da2",
        "payload_hash": "e198c64632c94458a0a382e2d3c5366a",
        "path_pattern_hash": "229c0a4c773f5f9eeec1d298c58088ee"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.htpasswd HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 5.1; Neffos C5 Max) AppleWebKit\/537.36 (",
    "event_signature": "bf8fdc115e8a0bcabc1d0ba92c7142dd0e74bde9",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950522:leak-9",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "log",
    "http_ua_hash": "eb17b1665c5f3363c03f4785331cb418a958e684",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "fc50733d76409093f90f46513edc67564b2421cb",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 262,
    "payload_entropy": 5.356494570516253,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "80663486b13ddfaada635c38fc6fef4f2fa08576",
    "event_fingerprint": "18f9c5e3cc9a5fa46629beb59ee1bacff27034b0",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "dc986d1dbf7c3af70e145ad406ad561a",
        "payload_hash": "ca56619406dbb8f2bacfe831344cb2da",
        "path_pattern_hash": "a4d176701e2b21dd6deff557491aab03"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/log\/error.log HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: SEC-SGHE900\/1.0 NetFront\/3.2 Profile\/MIDP-2.0 Configuration\/CLDC",
    "event_signature": "c6332fb1e54ca18e1dcd578e023806ad2bbc3e40",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_log",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "config",
    "http_ua_hash": "a31c702bdfef09fd7eae66cc20deec71c01755fe",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "fb61e36fe9095535f127e3353d957f1c1310e8e9",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 230,
    "payload_entropy": 5.284712043659266,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "a875e76a313647a03ce64ed4ed208913ce80a350",
    "event_fingerprint": "ac509491b83e72cca48529fe543c4657c1a0dcb0",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "ffdb5771031def79d8934f61136d7094",
        "payload_hash": "2e2e87eb93f90a6c3acdbca2cae9d23c",
        "path_pattern_hash": "0913647d7e838cdd727ceda37a671f37"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/web.config HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: DoCoMo\/2.0 N905i(c100;TB;W24H16) (compatible; Googlebot-Mobile\/2.1;",
    "event_signature": "a2e364754021cd68c53c2fd4a5ea5a0b483a4d05",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "htaccess",
    "http_ua_hash": "fada4e82d66b6839387533af637a6b7308301fea",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "3450b1e7f2decdc58edd085ce04b19bc7f5d6fac",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 270,
    "payload_entropy": 5.387125755875068,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "ba74ddd699df8c17f84d1b64f624011af5986f22",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "bed30f32250b555b2df6dbbadc66fb6d",
        "payload_hash": "b2d68077628164d00893313815ba032e",
        "path_pattern_hash": "4c27678faebafe822ea78c9ea1cb1efa"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.htaccess HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 12_3 like Mac OS X) AppleWebKit\/6",
    "event_signature": "8471920a013ce3cb7c21cad4dfc1016173ec4f6e",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "conf",
    "http_ua_hash": "90efff7270eb1ca7b519f25d33298997e52d7cc7",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "845c3b2b5656c277525928bf4edf7c41919ad7fa",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 269,
    "payload_entropy": 5.401130291876679,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "b3f208c7d643429dda6c0ea3defcae87c465aa43",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "601a25dbde45037d9559b36d9736ad9c",
        "payload_hash": "337d0061d27d3c31f92c7a1d75d7266b",
        "path_pattern_hash": "80f5fa98cca489e2cf5aa551565e088f"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/nginx.conf HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (iPod; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit\/600",
    "event_signature": "31bce9cf62fba9ad5c5ddc620e782980f73a791d",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "config",
    "http_ua_hash": "cf4daa810735681530e7ce11f8dabc2d799f7c5d",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "e275586080f0f32618bdbe0c80334164416e3043",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 250,
    "payload_entropy": 5.371976665842367,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "cfe611b465abd3040922869f8456c80e6c78188e",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "98126e600c6a96b80ae422fb3b2ffaea",
        "payload_hash": "ebb6233271a246f2752e5bd6e93819b5",
        "path_pattern_hash": "80871f7e109ea9867fd6173c2b32059b"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/nginx.config HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; Mi A2) AppleWebKit\/537.36 (KHTML, ",
    "event_signature": "6533242e0a1d0535afcd1c767799600f90af398f",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "xml",
    "http_ua_hash": "70786627c178fbcee97ea2b89593840b7a6f5022",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "524717bd951511cea8642b855a654b176416ff2d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 251,
    "payload_entropy": 5.4337300928117225,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "0de31c6e8974d0f7529369c7fcd33928ffcadf02",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "76032b95e0cd81daa665446febc57e25",
        "payload_hash": "81b2af4918255f352957780ff9859bbf",
        "path_pattern_hash": "d4d89f4ec79feb80a890ebb7bb0f42f9"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/server.xml HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit\/537.36 ",
    "event_signature": "84f45a494639aa9f3ee121446be85812cdca5284",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "gitconfig",
    "http_ua_hash": "3df4c8180ffcf5965502bca3b82e103e876f7c20",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "4552edeb48a162af2c0944497328c6fed5ef02ec",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 251,
    "payload_entropy": 5.394648085035043,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "92cfb060535a2a27488c7cef52341a2b43f1a2be",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "3be1a84eefbef370a455ffb3722e0bc6",
        "payload_hash": "a74ca22d5688384bfe618b6caca3e802",
        "path_pattern_hash": "15182e65e3e4c28fd6667d0a76628de0"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.gitconfig HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit\/537.36 ",
    "event_signature": "9150f83ee0b219e6a98819ff87434473376087c2",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "netrc",
    "http_ua_hash": "3658febe4dfb662dd247689cfc055f8485cd9115",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "b7551dc22135c68ecee0a4d011ec4c0b7c771e06",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 214,
    "payload_entropy": 5.154441300842961,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "16a466300af0806fa1b827d839f042c5b9ff04d4",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6d0ca10280eaf9ba3b16ab6eae25c98c",
        "payload_hash": "8fe93810a26a1f051fcd053be51d0467",
        "path_pattern_hash": "5fa317981ba713f7d39164540951d6bb"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.netrc HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Opera\/9.80 (Android; Opera Mini\/7.5.33361\/31.1543; U; en) Presto\/2.8.11",
    "event_signature": "44a96daa7a417c0af94975158f75f9b4d00b5758",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "npmrc",
    "http_ua_hash": "7349d262ad3577b56538fe398db8741e5d807dfe",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "e47e720fc12387d6362d15cf56ef7f004f4a216f",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 264,
    "payload_entropy": 5.480251349749836,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "7e0796d58fd8a07ad0035425df803aec64803a08",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "7f034b719a5c9752b73899fdf29a6695",
        "payload_hash": "ed7859c37dc69ec19016e09cd9be37cf",
        "path_pattern_hash": "7643d037b83b1eb932659ed1ccb7e4fe"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.npmrc HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 4.4.2; SAMSUNG-SM-T537A Build\/KOT49H) Apple",
    "event_signature": "7a1e8e65303a8ab1808640ec0000289369e5ef36",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "pypirc",
    "http_ua_hash": "ca35d74e05796f7988a94ed1338cd6588e2cb254",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "4f379f0493c77f8c140c8f093ef7d07d4d18769b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 280,
    "payload_entropy": 5.44496397507785,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "2b1b6e60856043cc3e4ccf95c2df7ab61230c673",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "8ba5c6515cf00a95c13450ef1541a010",
        "payload_hash": "9d61e029fb217fd79e04549b37d34d4e",
        "path_pattern_hash": "f4c8c175cb2aad95cfdfc95e8249602c"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.pypirc HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 8.0.0; moto e5 cruise Build\/OCPS27.91-157-",
    "event_signature": "a848a5a5d3337c11ba8343c10cefa685dda27ec5",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "bash_history",
    "http_ua_hash": "b7f82af2dee1c9b678fa2b4e317b8fb4968bf961",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "3740e867d7aba2aaaf44f99aaa36772f226b5d91",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 266,
    "payload_entropy": 5.491578482848139,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "31ec25f9cea9600037b302fe9dc5981734533c32",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "5914767f04910c71cb516b1f5e0918e9",
        "payload_hash": "31baac4dec34e93b999c222726330818",
        "path_pattern_hash": "70ca8eb80ffbde2088a35c267977e4d4"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.bash_history HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like ",
    "event_signature": "07a87406f57f420a422656a2d547a0917a57061a",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "ssh\/id_rsa",
    "http_ua_hash": "8863ece6aff0c813fc7fabeee2815599fd482a5c",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "d951dfd854ab99392c126a2628ec52b85415a678",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 259,
    "payload_entropy": 5.431933981937575,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 62,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "548205bce840a8947bf41609c5a00a8c23a39add",
    "event_fingerprint": "5241198f7632e8d877a5482ef8d7c7463b10ac84",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "11825e1479d51f9803dc9fe521e7d70a",
        "payload_hash": "ba6bca35a97c30052a6565be1700a5a9",
        "path_pattern_hash": "6eca2c923ad05fff3eba197c659999e2"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.98,
    "classification_confidence": 0.98,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.ssh\/id_rsa HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64) AppleWebKit\/537.36 (KHTML, li",
    "event_signature": "2f7b21763ef9dda0d0499a6c4ec40c8d31b300a0",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_id_rsa",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "ssh\/authorized_keys",
    "http_ua_hash": "f694f99cff565034e1e4fddf9aac9f1fdb313045",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "a25aaf7c350e380b4697c5b640d5d962e0f1dd91",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 254,
    "payload_entropy": 5.459713432765945,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "575546b282c91b63ba6446b4115b9b715c47d8f3",
    "event_fingerprint": "4d41e59fa6dca003092311ddcb1a8d05f322e736",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6dc82c8a3d57f2110191f3d1c13c7a38",
        "payload_hash": "b6dcd40ca9cb98f02007223f1083b635",
        "path_pattern_hash": "7cedd4ba646691da0a133647f6b04acc"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/.ssh\/authorized_keys HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.",
    "event_signature": "a3e6364d946300b21c23777ecc8026484a73a88c",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "1ca3d07ca2a5f2240056423fd2d30dc6d8a380d5",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "e7082bf89fb3315806e7ae6952f0a88884c69468",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 200,
    "payload_entropy": 5.293287818539688,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 32,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 32,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 41,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "564137fe7f71422a45227805f6e221e78e41bbb6",
    "event_fingerprint": "ca50725774d6ba0e9e2781f189ac5d0a02119e09",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "40fb971fa205970a741fc15042d3ed6a",
        "payload_hash": "d1c483bcb607181d34879186aa58353e",
        "path_pattern_hash": "7db94f5d7ea5ac98ea13d8c61becd367"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "web_injection"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/id_rsa HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: BlackBerry7100i\/4.1.0 Profile\/MIDP-2.0 Configuration\/CLDC-1.1 VendorID\/",
    "event_signature": "615aa94e8c02d86c22b8dea5e96741cef5de6c6a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "key",
    "http_ua_hash": "566b883c075529e1005d79cb614dcd9b0d91f0ec",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "778f1a2da806bd5e8dfbe960a44247fae7b2ad06",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 207,
    "payload_entropy": 5.31305745199195,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "e0e90842aba76ccd760d477cd263c0ad27fe11b2",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "64ba19fa9de15797ea35fdadd1bc636f",
        "payload_hash": "f51f8d77bc34b846222501016a63f514",
        "path_pattern_hash": "99d81cc4cfd81ec40e55a6efe29c670b"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/private.key HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; rv:10.0.1) Gecko\/20100101 Fire",
    "event_signature": "a14f2edad053f7626fb74a80cb1490e6afcab8ff",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "pem",
    "http_ua_hash": "ea68d43a4eec4996faa57cbd91e6510c02477dfe",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "0f51bc792d6f938bb82ea19d1935c3464eb59ea8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 149,
    "payload_entropy": 5.131978155344923,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 32,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "c9699b2b45c421b3c3c34971a566be1f31d86bc0",
    "event_fingerprint": "f702f11f0b2ebcf5eb17d19eb9066a3e0d90d2d6",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "45fe9210f26176bb2b3d438a5cd35127",
        "payload_hash": "2e211f0ed8da80f8e46d7cf5fba32a6a",
        "path_pattern_hash": "fb2942fad108fb946e981f9671efa9dc"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "ddos"
    ],
    "confidence": 0.68,
    "classification_confidence": 0.68,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/private_key.pem HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Twitterbot\/1.0\r\nAccept-Charset: utf-8\r\nAccept-Encoding: gzip\r\n",
    "event_signature": "dbb6f1850e0e0fc0745084865a4893fdba14d2bd",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "key",
    "http_ua_hash": "d132bdde37af872e8ac493c8cc22b5595d4ef1ac",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "cf1afbf8420628be2ea8315c59921f18b70510e8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 243,
    "payload_entropy": 5.440282671082083,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "d968fdd606a324cff94b7a7d0825526b82e15af5",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "57819b3b23420452ac601ea97c8e21ea",
        "payload_hash": "ae9491e5e73626eb2847f8b49c814ccd",
        "path_pattern_hash": "51ffc9c2865ea094d2e6b0576cde621f"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/server.key HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit\/537.36 (KHTML,",
    "event_signature": "618f774177fb2e2387e0e405b75f8c4b97d60a49",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "pem",
    "http_ua_hash": "fb421555db09fced69648f6726af353413309d8f",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "5fe380198269c9a1a6d0511e7b302de05ee3b072",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 251,
    "payload_entropy": 5.410045281848819,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 60,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 60,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2ca53b9d89408c48df0367d2469503efe8e7213a",
    "event_fingerprint": "545e5841735541d637632754e175f8e2d43fee02",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6915d10c5bac758cd8969be33236d029",
        "payload_hash": "d2c3eecbfa8b51cd3866bbeffd2509fc",
        "path_pattern_hash": "6d08c40a9dd5a1c7d52ff80a12d01067"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.89,
    "classification_confidence": 0.89,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/server.pem HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit\/537.36 ",
    "event_signature": "bcdda14f5aa1db0f872c21a5b724a30ca85ce66c",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.832988026906575,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 8,
    "risk_classification": 79,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 79,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ea92e9a01afdfaf4a8f8323f4aa8fc7e6210a798",
    "event_fingerprint": "ed512752271fda2eb0913bd07e4a5caeb0461dd3",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "bf1e4de786572e58d94a1679cc00202d",
        "path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "tls"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "ddos"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\u0003\u001c\ufffd\ufffd\ufffd\ufffdJR\ufffd\ufffd\ufffd\ufffdi1\ufffd\ufffd\ufffd<\ufffd!u\ufffd\ufffd\ufffd\ufffdc6\ufffd xA\ufffd\ufffdd\ufffd\ufffd\ufffd\u0018\ufffd\ufffd\ufffdJ\ufffd\ufffd\ufffd\ufffd\u0003)\ufffd9`'`,K\u0018\u0006\ufffd5_\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "75de8656bb48537d9a68962b410546dbe93e1c03",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "yml",
    "http_ua_hash": "638929f3064f432a4dd9bf717380be4ee4727fd4",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "81404a0e713cecbd98e4a8def2d59a96e3a35ae9",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 263,
    "payload_entropy": 5.4162538692426585,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 65,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "17dfa109a938de50afc65225214ca5d43c90f7f7",
    "event_fingerprint": "e83b7532b98a6df014e33692721e7858e80ba003",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "58223edb6287b2bb9977c8b2356d804d",
        "payload_hash": "03f0bba7d03b0da869188814b48c3330",
        "path_pattern_hash": "c3f43fa14f2661f53e10654828ce809f"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "path_traversal"
    ],
    "confidence": 1,
    "classification_confidence": 1,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/v2\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWe",
    "event_signature": "48723e9d8c0dde4bc33ecba5fa39b35b382cc28e",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "25c393ec8e5a5b68f77a76fae0beab72deb175ee",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "04a99df4e7f26fbef3b59fc449247949b0b5c67b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 261,
    "payload_entropy": 5.355140480789395,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "575546b282c91b63ba6446b4115b9b715c47d8f3",
    "event_fingerprint": "6bb28538d2512069e09ac772e875e2681826410c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "256955c701d97646f76d622c0e53d69e",
        "payload_hash": "c8b0e452b895b4ab781378fff2d63d7e",
        "path_pattern_hash": "4ea6034329b7a9b73f791b1e3c4a9abe"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 1.1; en-gb; dream) AppleWebKit\/",
    "event_signature": "5e99c490253bff5dbc3d94a67444eff1da8c8c45",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": "json",
    "http_ua_hash": "59fe7753801d9b0030bde7c6461fcc6a8be9f023",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "6b80f89580c29c439d19b48dd4ca5c498157500b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 258,
    "payload_entropy": 5.420206349090853,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 100,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 66,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "57dbab2bfabece3c618b4299a8ee3abcd9712c57",
    "event_fingerprint": "a39adb1d30957d0cfad4dd3b192670950a7bc2e1",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6a9b3a0f1e02bf4f12d32a74f30f4489",
        "payload_hash": "a31cfa5e81d41c5770658846bd01d63c",
        "path_pattern_hash": "a9426bbf6d4bd633fabcb2de52d2c4da"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "path_traversal"
    ],
    "confidence": 1,
    "classification_confidence": 1,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/api\/v2\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; CLT-L09) AppleWebKit\/537.36 ",
    "event_signature": "e571226134ab09a4e1cc6d5c70f74edd6fa7f50e",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950316:lfi-14",
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "950600:k8s-api",
        "http_probe_api",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "php",
    "http_ua_hash": "c69d6213fe5c8767cc9d5ae04aa11af131247976",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "dc69455821ac57112ed55bdc711cd96efef8bc30",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 231,
    "payload_entropy": 5.304560482222966,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "575546b282c91b63ba6446b4115b9b715c47d8f3",
    "event_fingerprint": "ff90b9b0a1c0b1ee15c825a5d7a92cf2e9fcfed0",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "f2caa6f96b4e986c3be442fe3008389e",
        "payload_hash": "a01a47c0425fd3b78d3d548b940fc172",
        "path_pattern_hash": "e579f5331fafd6744571a321a16ba912"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Opera\/9.80 (Android 4.0.4; Linux; Opera Mobi\/ADR-1205181138; U;",
    "event_signature": "029647c9e31ab7685b1a2aec11b6542aec69d199",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "850809c5a3e73831e71cbdc3254fcee5e398fc1b",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "26f7d724b3a468b82e3ba15c8d7bacb7b8061900",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 272,
    "payload_entropy": 5.461068734003989,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e61efc62d01535c4e6fbe8454e919a2b486de4a7",
    "event_fingerprint": "e8975fdd2110bc14ceab7711003c94bd3878ab80",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "32b792c5139b706d5fbac716c15fcb43",
        "payload_hash": "dede85a8c074825c837fc7713faa2aea",
        "path_pattern_hash": "6fb8a0463da694df32694fe856dd98b0"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/config.yml HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 7.1.2; Nexus 6P Build\/N2G48C) Apple",
    "event_signature": "76e8bac6527ea57a81d045deca95d224868f7456",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "php",
    "http_ua_hash": "ef47592d2daeaaf7187343ce82c6f089a6772de6",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "e4abf904a7fbb50714680cdacb7651db115a8c9e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 269,
    "payload_entropy": 5.367174570241294,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e61efc62d01535c4e6fbe8454e919a2b486de4a7",
    "event_fingerprint": "c92ceed99f1cafb939885011a2c72581b7079785",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "5c11371fdc0eab11747d42687f6483dc",
        "payload_hash": "ba95112b3e1e056757745dee9be4d62f",
        "path_pattern_hash": "074557b898337410ee45693d5713bf97"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/settings.php HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 9_1 like Mac OS X) AppleWe",
    "event_signature": "ee8d905aaabd1139b403af305aabed9450e3c547",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "cc60a5a5b486e3ddc2e821b48d97c6b7e676ea01",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "3e66acdca940555c8286ff150b8104f5f05e9a81",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 257,
    "payload_entropy": 5.450675789265495,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e61efc62d01535c4e6fbe8454e919a2b486de4a7",
    "event_fingerprint": "9c9a16d44db5d4e7a38f3b6e973ac2213a0c651d",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "a9d6716b2de05133eea636a8d94457de",
        "payload_hash": "3e0ad7650a2212cc1285ce7cec5ff704",
        "path_pattern_hash": "2061b58591e5ce4f0204a93af2bc8c78"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/database.yml HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SM-J701F) AppleWebKit\/537.36 (",
    "event_signature": "a4ace61d902071d2e9cb23d24fe639f801586ad8",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "9ad2b047ce8ce8c3335a6ac3c84c7f6211906d34",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "3f83effb2863f5237a9f1d32855ab0db532866de",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 254,
    "payload_entropy": 5.3536138134358655,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e61efc62d01535c4e6fbe8454e919a2b486de4a7",
    "event_fingerprint": "42ad9aa092e5c9462b85b7c2027f211fc9f1b051",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "e33a6b4a0a723894205bf67b7d7cd800",
        "payload_hash": "3357a1129f25e11b41f7507e1591ef4e",
        "path_pattern_hash": "5d85c4a4382e0798405df111e78142b3"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit\/",
    "event_signature": "3b7aeae519398bdd6f26d978cebcc9c7caeb8301",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "php",
    "http_ua_hash": "4376f63a596c003ed1845ef143b46dbc928ed065",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "99f443b92137aadbd624802466b4cf4d6f35cb3f",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 165,
    "payload_entropy": 5.13359492825192,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 32,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 32,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 41,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "52f238135fa237d743d81ed488e5dab73da61e24",
    "event_fingerprint": "da143b566c3be875713bdcb9227fc29151582a41",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "dc0b3bab18577d535a217974f66b8967",
        "payload_hash": "608077c6ff7ea4332a0173639684f606",
        "path_pattern_hash": "8a0fb801c8765f594f3fc8256184d7db"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "web_injection"
    ],
    "confidence": 0.71,
    "classification_confidence": 0.71,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/database.php HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Screaming Frog SEO Spider\/8.1\r\nAccept-Charset: utf-8\r\nAccept-",
    "event_signature": "6d14df00d5a734e1dbfc77ebf379cc1cc7d71e30",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950468:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "382da75523c223dfbcdd0e09421bce57344e47f9",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "2b1fad601acc14f5ed25efdafdf285e1c91df041",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 265,
    "payload_entropy": 5.448882405914848,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e61efc62d01535c4e6fbe8454e919a2b486de4a7",
    "event_fingerprint": "41b6c1e96f914a24f9f355a3cdd3ca605d5ea160",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6bbabc1122a148f3bcd19efa6fcb88b6",
        "payload_hash": "4436453c175421031f1ddea9eb853e11",
        "path_pattern_hash": "7bdd4b63d6391f4fc5a5b1867d0b1c5e"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/credentials.json HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML",
    "event_signature": "59da0673fb797ec51fef8d57efb98e243c108e1e",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "eb17b1665c5f3363c03f4785331cb418a958e684",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "a462f95e4a92cffbf9052da8b5be7c71cd3d0f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 265,
    "payload_entropy": 5.364671136262789,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "45ff211aa5857e1a50c6458c37bc675159e9108d",
    "event_fingerprint": "c93f0c8bd460a8b56c6f3bac3365c92bc6bf8cdb",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "dc986d1dbf7c3af70e145ad406ad561a",
        "payload_hash": "7c30cae77319fbe3c030cb31b951901f",
        "path_pattern_hash": "fde58f9faead7388f9a511e05901ca16"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/secrets.json HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: SEC-SGHE900\/1.0 NetFront\/3.2 Profile\/MIDP-2.0 Configuration\/C",
    "event_signature": "b6def695da9f2cc9580b0b02d589aa6e4d08ee3c",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_k8s_probe",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "86aa0f47a7f2556a891729ba910f5cf055fa44a8",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "b81cb99a957232977d1980a7f865cbc683e36d9d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 248,
    "payload_entropy": 5.418906056802056,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e61efc62d01535c4e6fbe8454e919a2b486de4a7",
    "event_fingerprint": "86cb5dc24899da93670136607b1bf88a7fdeb221",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "33af80933ae980783be0a1637c8232d0",
        "payload_hash": "456ecc6651346eacd1ffce503ba675ec",
        "path_pattern_hash": "e505f8db721eb16de5bb99f765ce1e5a"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/application.yml HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; WOW64) AppleWebKit\/537.36 (KH",
    "event_signature": "dbe8e83928113e2e7787b024d600b7495c880313",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "properties",
    "http_ua_hash": "3241cdebf0dc24c20546513ce1e68cc24d84417a",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "2f953c642188869b1a561e9c4740c219cba11ed1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 315,
    "payload_entropy": 5.479438689991646,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e61efc62d01535c4e6fbe8454e919a2b486de4a7",
    "event_fingerprint": "f9ca0e8f7f5f37da20b6a66f1446fa6820a540ab",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "221535853602893e86316f3d10bbe29e",
        "payload_hash": "4ef5ef9ad5f8e5df3c44c01921a42605",
        "path_pattern_hash": "286c03092fb4d6bd8948d162eabf9d1a"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/application.properties HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; SAMSUNG SM-G975U Bui",
    "event_signature": "57e588a5fb370e86999ee2764b1808f601052c6c",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.835272349139588,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 8,
    "risk_classification": 79,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 79,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ea92e9a01afdfaf4a8f8323f4aa8fc7e6210a798",
    "event_fingerprint": "ed512752271fda2eb0913bd07e4a5caeb0461dd3",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "425ca3806e0e4252a263b8ac726eea05",
        "path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "tls"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "ddos"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\r\ufffd|\ufffdy]D9\ufffd\u01f4\n\r\u001c\ufffd\bH]N\ufffd\ufffd \ufffd*S#\u001a\ufffd7\ufffd o\ufffdL\ufffdi\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\u0011h\ufffd1\ufffd\ufffd\ufffd@\ufffd\ufffd\/\ufffdI\ufffdA\ufffd\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "2aeed3a69f926cdf5f152c2367abd228cb3aff5c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "yml",
    "http_ua_hash": "d6d7bdc1e75d737043cc262ee917f8db64344080",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "4f55dc51ea1dea9fa7f5925bb0b65cb16d0fdae1",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 272,
    "payload_entropy": 5.4481340554528135,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 60,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e61efc62d01535c4e6fbe8454e919a2b486de4a7",
    "event_fingerprint": "546eccc15dedddf729b417db7e4d9eb3df8bc1da",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "431bba1e91d435c1469156e19e28c9fa",
        "payload_hash": "bdfe36e5c0f715e19824e6bcefb0487a",
        "path_pattern_hash": "59785b98ffcc7d5aed7dc5ac932d796d"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.92,
    "classification_confidence": 0.92,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/app\/parameters.yml HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.3",
    "event_signature": "509883ec129af0f3feeecda6c652bffb8e4d1928",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.798279563621234,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 8,
    "risk_classification": 79,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 79,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ea92e9a01afdfaf4a8f8323f4aa8fc7e6210a798",
    "event_fingerprint": "ed512752271fda2eb0913bd07e4a5caeb0461dd3",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "ee8529d983507131f0eb0baba5c2dc9a",
        "path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "tls"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "ddos"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\f)\u0001\ufffd\u0018\u0455\u0010\ufffd\ufffd9\ufffd\u0016F\"\ufffd\u06e3\u0006\ufffd;a\ufffd\ufffd[\ufffd@\ufffd\ufffdm\u0001\u0018 y\ufffd\ufffd\u018a\u0014\ufffd\ufffd\n7\ufffd\ufffd\ufffd\u0659\ufffdSn\ufffd\ufffdV\ufffd.\ufffd\u3b31\ufffdy\ufffdt\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "28f45d86187b79f920ea0ed5ee3769e53753e5ad",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.900012112235711,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 8,
    "risk_classification": 79,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 79,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ea92e9a01afdfaf4a8f8323f4aa8fc7e6210a798",
    "event_fingerprint": "ed512752271fda2eb0913bd07e4a5caeb0461dd3",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "00f0aea1f8d4bf2815cfd160d6b90214",
        "path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "tls"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "ddos"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003y\ufffdOPC\ufffd\ufffd\ufffd)T\ufffd\u010bK5\ufffd\ufffd\ufffdcAS\ufffd\u0003Uj\bG\u01ed\u001fw\ufffd \u001d{\ufffd\ufffdS\ufffd\ufffd\u0019\ufffd\ufffd\ufffd\u074fN\ufffd6\ufffd,\ufffdV\ufffd\ufffd\u001d\ufffd{W\u0019gV\ufffd}\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "883ae7bcd9552c43ff23a0a9df37fc9d3bd8055d",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "php",
    "http_ua_hash": "89e6abe6a3f1d5a391ac7c0eb8cf70acf5ba31dd",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "0f76041769be813ece64207c970ee1807850a543",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 252,
    "payload_entropy": 5.425080039415367,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "575546b282c91b63ba6446b4115b9b715c47d8f3",
    "event_fingerprint": "62b6cb0942dc5b1af4468ef1766ee4f750e806e0",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "44b94a6902ea38a9e8505e05db84b069",
        "payload_hash": "55c62a2da66b8e95c10ce5800e857f02",
        "path_pattern_hash": "5736f534a7045a63aa72293badb5c26d"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/backend\/config.php HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit\/537.36",
    "event_signature": "cd50fee879c52e4b6ab0b88334c0ba015f57adb0",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.855023415293086,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 8,
    "risk_classification": 79,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 79,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ea92e9a01afdfaf4a8f8323f4aa8fc7e6210a798",
    "event_fingerprint": "ed512752271fda2eb0913bd07e4a5caeb0461dd3",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "1792f19fb36271074aac6bef29650311",
        "path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "tls"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "ddos"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003x\ufffd\ufffd\f\ufffd\u0007\ufffdRwJ\ufffd\u03c5\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(b\u0006\ufffd\ufffd&\ufffd,\ufffdt u\ufffd\"\u0001\u0014\ufffdA\u000e9e\ufffd\u0698\b_\u0015J\u001f\u0016\ufffd\ufffd\ufffd\u00e7s\ufffd\ufffd\ufffdo%\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "eaccf6b1717bacc19bcf19752366238ffa3e0a53",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "json",
    "http_ua_hash": "4eea7ea7bdf3935000bfe1da6c96d7e2de95e357",
    "http_host_hash": "5d6a0f825efad99b3fccf17c8b6d0547385a0b8b",
    "http_target_hash": "dd4e7c6dae63b29d8a16bb2d08dd16eadae1388d",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 274,
    "payload_entropy": 5.38711611033954,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 84,
    "risk_classification": 88,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 88,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "575546b282c91b63ba6446b4115b9b715c47d8f3",
    "event_fingerprint": "0f9ea39340f4d317907dc943f6a5e783136b1a36",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "6d17bb3536a364826ae43fe2a00191c2",
        "payload_hash": "e8b0bd69b1f915a547abfcf95968ffbf",
        "path_pattern_hash": "6b5c0538270e7ecfd1e78d9e9655554f"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "http"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "rce_probe"
    ],
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/backend\/config.json HTTP\/1.1\r\nHost: 62.3.50.33:2379\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) A",
    "event_signature": "df6c1eac1a90aba32b98cf5121aa9c05ccb02ffb",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_sensitive_path",
        "net_flood"
    ],
    "asn_dc_heuristic": true
}

{
    "tls_ja3_hash": "19e29534fd49dd27d09234e639c4057e",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "bytes_in": 239,
    "payload_entropy": 5.8327680384099505,
    "port_category": "registered",
    "org": "Google LLC",
    "service": "tls",
    "app_proto": "tls",
    "asn": 396982,
    "country": "TW",
    "dst_port": 2379,
    "risk_waf": 8,
    "risk_classification": 79,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 79,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ea92e9a01afdfaf4a8f8323f4aa8fc7e6210a798",
    "event_fingerprint": "ed512752271fda2eb0913bd07e4a5caeb0461dd3",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "TW",
        "asn": 396982,
        "org": "Google LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "19e29534fd49dd27d09234e639c4057e",
        "payload_hash": "f44a596c4ce4f232345cddc2e445f55b",
        "path_pattern_hash": "18ea0213c0d23e39dd8461c4478348f1"
    },
    "target_context": {
        "dst_port": 2379,
        "service": "tls"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "threat_family": [
        "ddos"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0012\u001d\ufffd\u0013\ufffdQ\ufffdQ.\ufffd\u0000F\ufffd\ufffd\ua621\u0011\u0015\u0002*Kr\ufffdB\ufffd\ufffd\ufffdSX\ufffd S\ufffd\ufffd\ufffd\u0012(\u039e\ufffd\f\ufffd\ufffd\ufffd\ufffd\ufffdw\b\ufffd\u0003\ufffd\ufffd\ufffd\ufffdr\ufffd\u043e\ufffd4S\ufffd\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000w\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "event_signature": "d271c76120b4fe7da98c912393a8d281e298b476",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ],
    "asn_dc_heuristic": true
}