36.35.30.255

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8710300351186038,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b00ed53514f1e815a083c4312425f4b8",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003+\ufffd\u0265\ufffdx\ufffd\ufffd\ufffd\ufffd\u0019\ufffd7\ufffd\b\ufffdB\ufffd\u0006\u0001,\u000b\ufffd\ufffdR\ufffdA\ufffd\u00109\u00002 \ufffd]j`\ufffd{:\ufffd\ufffd\\\u00145\ufffd8\ufffd!\u07e2U\u0017\ufffd\ufffd\ufffdi\ufffd\u000f\u001f\u0003\ufffd-\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003+\ufffd\u0265\ufffdx\ufffd\ufffd\ufffd\ufffd\u0019\ufffd7\ufffd\b\ufffdB\ufffd\u0006\u0001,\u000b\ufffd\ufffdR\ufffdA\ufffd\u00109\u00002 \ufffd]j`\ufffd{:\ufffd\ufffd\\\u00145\ufffd8\ufffd!\u07e2U\u0017\ufffd\ufffd\ufffdi\ufffd\u000f\u001f\u0003\ufffd-\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \t\ufffdyK\u0011",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003+\ufffd\u0265\ufffdx\ufffd\ufffd\ufffd\ufffd\u0019\ufffd7\ufffd\b\ufffdB\ufffd\u0006\u0001,\u000b\ufffd\ufffdR\ufffdA\ufffd\u00109\u00002 \ufffd]j`\ufffd{:\ufffd\ufffd\\\u00145\ufffd8\ufffd!\u07e2U\u0017\ufffd\ufffd\ufffdi\ufffd\u000f\u001f\u0003\ufffd-\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0302e32fe289a2ca0067d367af4faeadda10a481",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003+\ufffd\u0265\ufffdx\ufffd\ufffd\ufffd\ufffd\u0019\ufffd7\ufffd\b\ufffdB\ufffd\u0006\u0001,\u000b\ufffd\ufffdR\ufffdA\ufffd\u00109\u00002 \ufffd]j`\ufffd{:\ufffd\ufffd\\\u00145\ufffd8\ufffd!\u07e2U\u0017\ufffd\ufffd\ufffdi\ufffd\u000f\u001f\u0003\ufffd-\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd+\ufffd\u0265\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffdB\ufffd,\ufffd\ufffdR\ufffdA\ufffd92 \ufffd]j`\ufffd{:\ufffd\ufffd\\5\ufffd8\ufffd!\u07e2U\ufffd\ufffd\ufffdi\ufffd\ufffd-\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003+\ufffd\u0265\ufffdx\ufffd\ufffd\ufffd\ufffd\u0019\ufffd7\ufffd\b\ufffdB\ufffd\u0006\u0001,\u000b\ufffd\ufffdR\ufffdA\ufffd\u00109\u00002 \ufffd]j`\ufffd{:\ufffd\ufffd\\\u00145\ufffd8\ufffd!\u07e2U\u0017\ufffd\ufffd\ufffdi\ufffd\u000f\u001f\u0003\ufffd-\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd+\ufffd\u0265\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffdB\ufffd,\ufffd\ufffdR\ufffdA\ufffd92 \ufffd]j`\ufffd{:\ufffd\ufffd\\5\ufffd8\ufffd!\u07e2U\ufffd\ufffd\ufffdi\ufffd\ufffd-\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.912170539810779,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "93aa350c30aaebfc5231c8bc23278a8a",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\ufffd\u05dd\u0635\u0005j\ufffd\ufffdF\u001a\ufffd\ufffd\ufffdb\ufffd%]p\"\u000bc\ufffd\u00175\ufffd\ufffdOq A\ufffdO\ufffd\ufffd\u0019\ufffdD\u03b0\ufffd\ufffd\ufffdF\"\ufffdK\ufffd\ufffd\ufffd\ufffdyX\ufffd\ufffd\u934d\u00dc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\ufffd\u05dd\u0635\u0005j\ufffd\ufffdF\u001a\ufffd\ufffd\ufffdb\ufffd%]p\"\u000bc\ufffd\u00175\ufffd\ufffdOq A\ufffdO\ufffd\ufffd\u0019\ufffdD\u03b0\ufffd\ufffd\ufffdF\"\ufffdK\ufffd\ufffd\ufffd\ufffdyX\ufffd\ufffd\u934d\u00dc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdX\ufffd\ufffd\u0015\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\ufffd\u05dd\u0635\u0005j\ufffd\ufffdF\u001a\ufffd\ufffd\ufffdb\ufffd%]p\"\u000bc\ufffd\u00175\ufffd\ufffdOq A\ufffdO\ufffd\ufffd\u0019\ufffdD\u03b0\ufffd\ufffd\ufffdF\"\ufffdK\ufffd\ufffd\ufffd\ufffdyX\ufffd\ufffd\u934d\u00dc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "25baccc2da0e2ccb6a99d0ac27c747d6aa962c38",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\ufffd\u05dd\u0635\u0005j\ufffd\ufffdF\u001a\ufffd\ufffd\ufffdb\ufffd%]p\"\u000bc\ufffd\u00175\ufffd\ufffdOq A\ufffdO\ufffd\ufffd\u0019\ufffdD\u03b0\ufffd\ufffd\ufffdF\"\ufffdK\ufffd\ufffd\ufffd\ufffdyX\ufffd\ufffd\u934d\u00dc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd8\ufffd\ufffd\u05dd\u0635j\ufffd\ufffdF\ufffd\ufffd\ufffdb\ufffd%]p\"c\ufffd5\ufffd\ufffdOq A\ufffdO\ufffd\ufffd\ufffdD\u03b0\ufffd\ufffd\ufffdF\"\ufffdK\ufffd\ufffd\ufffd\ufffdyX\ufffd\ufffd\u934d\u00dc$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00038\ufffd\ufffd\u05dd\u0635\u0005j\ufffd\ufffdF\u001a\ufffd\ufffd\ufffdb\ufffd%]p\"\u000bc\ufffd\u00175\ufffd\ufffdOq A\ufffdO\ufffd\ufffd\u0019\ufffdD\u03b0\ufffd\ufffd\ufffdF\"\ufffdK\ufffd\ufffd\ufffd\ufffdyX\ufffd\ufffd\u934d\u00dc\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd8\ufffd\ufffd\u05dd\u0635j\ufffd\ufffdF\ufffd\ufffd\ufffdb\ufffd%]p\"c\ufffd5\ufffd\ufffdOq A\ufffdO\ufffd\ufffd\ufffdD\u03b0\ufffd\ufffd\ufffdF\"\ufffdK\ufffd\ufffd\ufffd\ufffdyX\ufffd\ufffd\u934d\u00dc$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.900525149444174,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7a994682d88eca133f54022ca5243021",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdN\ufffds\fHQ\ufffd\ufffdB~\ufffd\ufffd\ufffd\ufffd\ufffdSog\u0017\u0415\u0014\ufffd\ufffd)\ufffd\ufffd5 8&T\ufffd\ufffdJN\ufffd\ufffd\ufffd_7V\u0012)>L|b\ufffd\ufffd\ufffd~\ufffd%\ufffd\u000e\u001a\ufffd\u0012q\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdN\ufffds\fHQ\ufffd\ufffdB~\ufffd\ufffd\ufffd\ufffd\ufffdSog\u0017\u0415\u0014\ufffd\ufffd)\ufffd\ufffd5 8&T\ufffd\ufffdJN\ufffd\ufffd\ufffd_7V\u0012)>L|b\ufffd\ufffd\ufffd~\ufffd%\ufffd\u000e\u001a\ufffd\u0012q\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 p\r\ufffd\fl\u001b",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdN\ufffds\fHQ\ufffd\ufffdB~\ufffd\ufffd\ufffd\ufffd\ufffdSog\u0017\u0415\u0014\ufffd\ufffd)\ufffd\ufffd5 8&T\ufffd\ufffdJN\ufffd\ufffd\ufffd_7V\u0012)>L|b\ufffd\ufffd\ufffd~\ufffd%\ufffd\u000e\u001a\ufffd\u0012q\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fa6093c6365e2725c97cca02e55b04d113d502c5",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdN\ufffds\fHQ\ufffd\ufffdB~\ufffd\ufffd\ufffd\ufffd\ufffdSog\u0017\u0415\u0014\ufffd\ufffd)\ufffd\ufffd5 8&T\ufffd\ufffdJN\ufffd\ufffd\ufffd_7V\u0012)>L|b\ufffd\ufffd\ufffd~\ufffd%\ufffd\u000e\u001a\ufffd\u0012q\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdN\ufffdsHQ\ufffd\ufffdB~\ufffd\ufffd\ufffd\ufffd\ufffdSog\u0415\ufffd\ufffd)\ufffd\ufffd5 8&T\ufffd\ufffdJN\ufffd\ufffd\ufffd_7V)>L|b\ufffd\ufffd\ufffd~\ufffd%\ufffd\ufffdq$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0013\ufffd\ufffdN\ufffds\fHQ\ufffd\ufffdB~\ufffd\ufffd\ufffd\ufffd\ufffdSog\u0017\u0415\u0014\ufffd\ufffd)\ufffd\ufffd5 8&T\ufffd\ufffdJN\ufffd\ufffd\ufffd_7V\u0012)>L|b\ufffd\ufffd\ufffd~\ufffd%\ufffd\u000e\u001a\ufffd\u0012q\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdN\ufffdsHQ\ufffd\ufffdB~\ufffd\ufffd\ufffd\ufffd\ufffdSog\u0415\ufffd\ufffd)\ufffd\ufffd5 8&T\ufffd\ufffdJN\ufffd\ufffd\ufffd_7V)>L|b\ufffd\ufffd\ufffd~\ufffd%\ufffd\ufffdq$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8986287277974703,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5c2c08a78f64921311145339fa00cc90",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003>\ufffd\ufffd\u0007\ufffd\ufffdA\u0014Fm5i\t\u0017\ufffd_\ufffdX\u009dr\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd`\ufffd\ufffd \u0010\ufffd\ufffd\u0002<\ufffd\/\ufffd\ufffd\u02a4u\ufffd3bT\ufffd\u0017\ufffd\u0011\u0006\ufffd\ufffdd\ufffdG\ufffd\ufffd|M\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003>\ufffd\ufffd\u0007\ufffd\ufffdA\u0014Fm5i\t\u0017\ufffd_\ufffdX\u009dr\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd`\ufffd\ufffd \u0010\ufffd\ufffd\u0002<\ufffd\/\ufffd\ufffd\u02a4u\ufffd3bT\ufffd\u0017\ufffd\u0011\u0006\ufffd\ufffdd\ufffdG\ufffd\ufffd|M\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd&\ufffd\ufffdu",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003>\ufffd\ufffd\u0007\ufffd\ufffdA\u0014Fm5i\t\u0017\ufffd_\ufffdX\u009dr\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd`\ufffd\ufffd \u0010\ufffd\ufffd\u0002<\ufffd\/\ufffd\ufffd\u02a4u\ufffd3bT\ufffd\u0017\ufffd\u0011\u0006\ufffd\ufffdd\ufffdG\ufffd\ufffd|M\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "75e60feee7d8e84be9e2a6b2df84d44e94ab5709",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003>\ufffd\ufffd\u0007\ufffd\ufffdA\u0014Fm5i\t\u0017\ufffd_\ufffdX\u009dr\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd`\ufffd\ufffd \u0010\ufffd\ufffd\u0002<\ufffd\/\ufffd\ufffd\u02a4u\ufffd3bT\ufffd\u0017\ufffd\u0011\u0006\ufffd\ufffdd\ufffdG\ufffd\ufffd|M\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd>\ufffd\ufffd\ufffd\ufffdAFm5i\t\ufffd_\ufffdX\u009dr\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd`\ufffd\ufffd \ufffd\ufffd<\ufffd\/\ufffd\ufffd\u02a4u\ufffd3bT\ufffd\ufffd\ufffd\ufffdd\ufffdG\ufffd\ufffd|M\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003>\ufffd\ufffd\u0007\ufffd\ufffdA\u0014Fm5i\t\u0017\ufffd_\ufffdX\u009dr\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd`\ufffd\ufffd \u0010\ufffd\ufffd\u0002<\ufffd\/\ufffd\ufffd\u02a4u\ufffd3bT\ufffd\u0017\ufffd\u0011\u0006\ufffd\ufffdd\ufffdG\ufffd\ufffd|M\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd>\ufffd\ufffd\ufffd\ufffdAFm5i\t\ufffd_\ufffdX\u009dr\ufffd\ufffd\ufffd\ufffd\t\ufffd\ufffd`\ufffd\ufffd \ufffd\ufffd<\ufffd\/\ufffd\ufffd\u02a4u\ufffd3bT\ufffd\ufffd\ufffd\ufffdd\ufffdG\ufffd\ufffd|M\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8729434682992476,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "34bd6648063d35ca89c1febbfd8d2327",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdpI\ufffd\ufffdo\ufffd\u059e\ufffd\ufffd4u`\ufffd{Q\ufffd\ufffdh\ufffd\ufffd\ufffdqa\ufffd\ufffd\u0000pp\ufffd \ufffd\ufffd\ufffd\u05315Z\u0006F\ufffd\ufffd`Wg3\ufffd{\b4\ufffd\ufffd1K\ufffdk\ufffd@\u001c\ufffd{\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdpI\ufffd\ufffdo\ufffd\u059e\ufffd\ufffd4u`\ufffd{Q\ufffd\ufffdh\ufffd\ufffd\ufffdqa\ufffd\ufffd\u0000pp\ufffd \ufffd\ufffd\ufffd\u05315Z\u0006F\ufffd\ufffd`Wg3\ufffd{\b4\ufffd\ufffd1K\ufffdk\ufffd@\u001c\ufffd{\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 *R:X\ufffdi",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdpI\ufffd\ufffdo\ufffd\u059e\ufffd\ufffd4u`\ufffd{Q\ufffd\ufffdh\ufffd\ufffd\ufffdqa\ufffd\ufffd\u0000pp\ufffd \ufffd\ufffd\ufffd\u05315Z\u0006F\ufffd\ufffd`Wg3\ufffd{\b4\ufffd\ufffd1K\ufffdk\ufffd@\u001c\ufffd{\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9a017dec316937146ac2ad4c73cc02f0fda3c5dc",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdpI\ufffd\ufffdo\ufffd\u059e\ufffd\ufffd4u`\ufffd{Q\ufffd\ufffdh\ufffd\ufffd\ufffdqa\ufffd\ufffd\u0000pp\ufffd \ufffd\ufffd\ufffd\u05315Z\u0006F\ufffd\ufffd`Wg3\ufffd{\b4\ufffd\ufffd1K\ufffdk\ufffd@\u001c\ufffd{\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdpI\ufffd\ufffdo\ufffd\u059e\ufffd\ufffd4u`\ufffd{Q\ufffd\ufffdh\ufffd\ufffd\ufffdqa\ufffd\ufffdpp\ufffd \ufffd\ufffd\ufffd\u05315ZF\ufffd\ufffd`Wg3\ufffd{4\ufffd\ufffd1K\ufffdk\ufffd@\ufffd{\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdpI\ufffd\ufffdo\ufffd\u059e\ufffd\ufffd4u`\ufffd{Q\ufffd\ufffdh\ufffd\ufffd\ufffdqa\ufffd\ufffd\u0000pp\ufffd \ufffd\ufffd\ufffd\u05315Z\u0006F\ufffd\ufffd`Wg3\ufffd{\b4\ufffd\ufffd1K\ufffdk\ufffd@\u001c\ufffd{\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdpI\ufffd\ufffdo\ufffd\u059e\ufffd\ufffd4u`\ufffd{Q\ufffd\ufffdh\ufffd\ufffd\ufffdqa\ufffd\ufffdpp\ufffd \ufffd\ufffd\ufffd\u05315ZF\ufffd\ufffd`Wg3\ufffd{4\ufffd\ufffd1K\ufffdk\ufffd@\ufffd{\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8721827818725765,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d89eaf672d2ff8e2f2a2448459980435",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\ufffdP\ufffd\/%\u0247M3;\ufffd\ufffd\u0018d\u0012\u0375\ufffds\"Z\ufffd\"wp\ufffd;\ufffd {K\ufffd\ufffd\ufffd\u0012\ufffd8\ufffd\u0001 \ufffd\ufffd\ufffd\ufffd\u000b\u0017\ufffd\ufffdLu:\ufffd\ufffd\ufffde};\ufffd\u058d\u0004\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\ufffdP\ufffd\/%\u0247M3;\ufffd\ufffd\u0018d\u0012\u0375\ufffds\"Z\ufffd\"wp\ufffd;\ufffd {K\ufffd\ufffd\ufffd\u0012\ufffd8\ufffd\u0001 \ufffd\ufffd\ufffd\ufffd\u000b\u0017\ufffd\ufffdLu:\ufffd\ufffd\ufffde};\ufffd\u058d\u0004\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 G)\ufffd\u0001\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\ufffdP\ufffd\/%\u0247M3;\ufffd\ufffd\u0018d\u0012\u0375\ufffds\"Z\ufffd\"wp\ufffd;\ufffd {K\ufffd\ufffd\ufffd\u0012\ufffd8\ufffd\u0001 \ufffd\ufffd\ufffd\ufffd\u000b\u0017\ufffd\ufffdLu:\ufffd\ufffd\ufffde};\ufffd\u058d\u0004\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5d9e50b439262619a8cd030167cbf75bb42c9be5",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\ufffdP\ufffd\/%\u0247M3;\ufffd\ufffd\u0018d\u0012\u0375\ufffds\"Z\ufffd\"wp\ufffd;\ufffd {K\ufffd\ufffd\ufffd\u0012\ufffd8\ufffd\u0001 \ufffd\ufffd\ufffd\ufffd\u000b\u0017\ufffd\ufffdLu:\ufffd\ufffd\ufffde};\ufffd\u058d\u0004\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd.\ufffdP\ufffd\/%\u0247M3;\ufffd\ufffdd\u0375\ufffds\"Z\ufffd\"wp\ufffd;\ufffd {K\ufffd\ufffd\ufffd\ufffd8\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdLu:\ufffd\ufffd\ufffde};\ufffd\u058d$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd.\ufffdP\ufffd\/%\u0247M3;\ufffd\ufffd\u0018d\u0012\u0375\ufffds\"Z\ufffd\"wp\ufffd;\ufffd {K\ufffd\ufffd\ufffd\u0012\ufffd8\ufffd\u0001 \ufffd\ufffd\ufffd\ufffd\u000b\u0017\ufffd\ufffdLu:\ufffd\ufffd\ufffde};\ufffd\u058d\u0004\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd.\ufffdP\ufffd\/%\u0247M3;\ufffd\ufffdd\u0375\ufffds\"Z\ufffd\"wp\ufffd;\ufffd {K\ufffd\ufffd\ufffd\ufffd8\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdLu:\ufffd\ufffd\ufffde};\ufffd\u058d$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.846633522219467,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bbad86c2ab09d0ec2adff316785b9d5a",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd\ufffd\ufffdx\ufffd\ufffd\u000fN\ufffd\u0006\ufffd\ufffd\u0000W\ufffd\ufffd`=\ufffd\ufffdh\ufffd\ufffde\ufffd\ufffd\ufffd\u02c8\u0004 \u001c\ufffd\u0253\u0001\u02e7\ufffd[\ufffd\ufffd\ufffd\ufffdpTS(>\ufffd\ufffd'\ufffd\ufffd\ufffdX\ufffd\ufffd\u001ba\ufffd;\u0006\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd\ufffd\ufffdx\ufffd\ufffd\u000fN\ufffd\u0006\ufffd\ufffd\u0000W\ufffd\ufffd`=\ufffd\ufffdh\ufffd\ufffde\ufffd\ufffd\ufffd\u02c8\u0004 \u001c\ufffd\u0253\u0001\u02e7\ufffd[\ufffd\ufffd\ufffd\ufffdpTS(>\ufffd\ufffd'\ufffd\ufffd\ufffdX\ufffd\ufffd\u001ba\ufffd;\u0006\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 r-\ufffd\ufffd\u0015\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd\ufffd\ufffdx\ufffd\ufffd\u000fN\ufffd\u0006\ufffd\ufffd\u0000W\ufffd\ufffd`=\ufffd\ufffdh\ufffd\ufffde\ufffd\ufffd\ufffd\u02c8\u0004 \u001c\ufffd\u0253\u0001\u02e7\ufffd[\ufffd\ufffd\ufffd\ufffdpTS(>\ufffd\ufffd'\ufffd\ufffd\ufffdX\ufffd\ufffd\u001ba\ufffd;\u0006\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fbba1dbdf2b79eb8c2f06535c1381cc2d1c616f8",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd\ufffd\ufffdx\ufffd\ufffd\u000fN\ufffd\u0006\ufffd\ufffd\u0000W\ufffd\ufffd`=\ufffd\ufffdh\ufffd\ufffde\ufffd\ufffd\ufffd\u02c8\u0004 \u001c\ufffd\u0253\u0001\u02e7\ufffd[\ufffd\ufffd\ufffd\ufffdpTS(>\ufffd\ufffd'\ufffd\ufffd\ufffdX\ufffd\ufffd\u001ba\ufffd;\u0006\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdn\ufffd\ufffd\ufffdx\ufffd\ufffdN\ufffd\ufffd\ufffdW\ufffd\ufffd`=\ufffd\ufffdh\ufffd\ufffde\ufffd\ufffd\ufffd\u02c8 \ufffd\u0253\u02e7\ufffd[\ufffd\ufffd\ufffd\ufffdpTS(>\ufffd\ufffd'\ufffd\ufffd\ufffdX\ufffd\ufffda\ufffd;$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdn\ufffd\ufffd\ufffdx\ufffd\ufffd\u000fN\ufffd\u0006\ufffd\ufffd\u0000W\ufffd\ufffd`=\ufffd\ufffdh\ufffd\ufffde\ufffd\ufffd\ufffd\u02c8\u0004 \u001c\ufffd\u0253\u0001\u02e7\ufffd[\ufffd\ufffd\ufffd\ufffdpTS(>\ufffd\ufffd'\ufffd\ufffd\ufffdX\ufffd\ufffd\u001ba\ufffd;\u0006\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdn\ufffd\ufffd\ufffdx\ufffd\ufffdN\ufffd\ufffd\ufffdW\ufffd\ufffd`=\ufffd\ufffdh\ufffd\ufffde\ufffd\ufffd\ufffd\u02c8 \ufffd\u0253\u02e7\ufffd[\ufffd\ufffd\ufffd\ufffdpTS(>\ufffd\ufffd'\ufffd\ufffd\ufffdX\ufffd\ufffda\ufffd;$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.87754671924349,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e2f288860afe5b3c577f1a5400fe794e",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0018J\u023bmw\ufffd\nxtk@\ufffd\b\u021b'\ufffd\ufffdR\ufffd\u0017\ufffd%`z\ufffd\ufffdsJ\ufffd \u0017{\ufffd0A$5\"x\ufffdbs\ufffd)\u0004\ufffdPz\ufffdh\ufffd7\ufffd\u001a\u686c\ufffd\ufffd*\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0018J\u023bmw\ufffd\nxtk@\ufffd\b\u021b'\ufffd\ufffdR\ufffd\u0017\ufffd%`z\ufffd\ufffdsJ\ufffd \u0017{\ufffd0A$5\"x\ufffdbs\ufffd)\u0004\ufffdPz\ufffdh\ufffd7\ufffd\u001a\u686c\ufffd\ufffd*\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u03d3'|\u001e\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0018J\u023bmw\ufffd\nxtk@\ufffd\b\u021b'\ufffd\ufffdR\ufffd\u0017\ufffd%`z\ufffd\ufffdsJ\ufffd \u0017{\ufffd0A$5\"x\ufffdbs\ufffd)\u0004\ufffdPz\ufffdh\ufffd7\ufffd\u001a\u686c\ufffd\ufffd*\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6215020fea11dcff6655edf4aac2ad135a129e4d",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0018J\u023bmw\ufffd\nxtk@\ufffd\b\u021b'\ufffd\ufffdR\ufffd\u0017\ufffd%`z\ufffd\ufffdsJ\ufffd \u0017{\ufffd0A$5\"x\ufffdbs\ufffd)\u0004\ufffdPz\ufffdh\ufffd7\ufffd\u001a\u686c\ufffd\ufffd*\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdJ\u023bmw\ufffd\nxtk@\ufffd\u021b'\ufffd\ufffdR\ufffd\ufffd%`z\ufffd\ufffdsJ\ufffd {\ufffd0A$5\"x\ufffdbs\ufffd)\ufffdPz\ufffdh\ufffd7\ufffd\u686c\ufffd\ufffd*\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0018J\u023bmw\ufffd\nxtk@\ufffd\b\u021b'\ufffd\ufffdR\ufffd\u0017\ufffd%`z\ufffd\ufffdsJ\ufffd \u0017{\ufffd0A$5\"x\ufffdbs\ufffd)\u0004\ufffdPz\ufffdh\ufffd7\ufffd\u001a\u686c\ufffd\ufffd*\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdJ\u023bmw\ufffd\nxtk@\ufffd\u021b'\ufffd\ufffdR\ufffd\ufffd%`z\ufffd\ufffdsJ\ufffd {\ufffd0A$5\"x\ufffdbs\ufffd)\ufffdPz\ufffdh\ufffd7\ufffd\u686c\ufffd\ufffd*\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8764682559175716,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "26b7c798831bffd71370b4aa6250b299",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0014\ufffd~\ufffd\ufffd\ufffd`\u0006\u04a3\ufffd-\u0001\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd@\u04fc\ufffd-\ufffdO\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdA\ufffdS\ufffd\ufffd\u0017\ufffd^!\ufffd\ufffdq\ufffd#r\ufffdCa\ufffd\u0000\ufffd\u001e\u070f\ufffdpR\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0014\ufffd~\ufffd\ufffd\ufffd`\u0006\u04a3\ufffd-\u0001\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd@\u04fc\ufffd-\ufffdO\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdA\ufffdS\ufffd\ufffd\u0017\ufffd^!\ufffd\ufffdq\ufffd#r\ufffdCa\ufffd\u0000\ufffd\u001e\u070f\ufffdpR\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdd\u0007v%;",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0014\ufffd~\ufffd\ufffd\ufffd`\u0006\u04a3\ufffd-\u0001\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd@\u04fc\ufffd-\ufffdO\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdA\ufffdS\ufffd\ufffd\u0017\ufffd^!\ufffd\ufffdq\ufffd#r\ufffdCa\ufffd\u0000\ufffd\u001e\u070f\ufffdpR\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "17368c66c0ab25c2f32b5e0fc28e7213b47e0eee",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0014\ufffd~\ufffd\ufffd\ufffd`\u0006\u04a3\ufffd-\u0001\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd@\u04fc\ufffd-\ufffdO\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdA\ufffdS\ufffd\ufffd\u0017\ufffd^!\ufffd\ufffdq\ufffd#r\ufffdCa\ufffd\u0000\ufffd\u001e\u070f\ufffdpR\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd~\ufffd\ufffd\ufffd`\u04a3\ufffd-\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd@\u04fc\ufffd-\ufffdO\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdA\ufffdS\ufffd\ufffd\ufffd^!\ufffd\ufffdq\ufffd#r\ufffdCa\ufffd\ufffd\u070f\ufffdpR\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0014\ufffd~\ufffd\ufffd\ufffd`\u0006\u04a3\ufffd-\u0001\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd@\u04fc\ufffd-\ufffdO\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdA\ufffdS\ufffd\ufffd\u0017\ufffd^!\ufffd\ufffdq\ufffd#r\ufffdCa\ufffd\u0000\ufffd\u001e\u070f\ufffdpR\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd~\ufffd\ufffd\ufffd`\u04a3\ufffd-\ufffd\ufffdn\ufffd\ufffd\ufffd\ufffd@\u04fc\ufffd-\ufffdO\ufffd\ufffd\ufffd\ufffd \ufffd\ufffdA\ufffdS\ufffd\ufffd\ufffd^!\ufffd\ufffdq\ufffd#r\ufffdCa\ufffd\ufffd\u070f\ufffdpR\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8956528450137533,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bc8849dff68d8ecb12c0fad0c7f9f6a8",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdz:\ufffdN\ufffd\u0006\u001eX\ufffd=\ufffd\ufffd\ufffd\ufffd5\ufffdJ\u028b\ufffd\ufffd|su\ufffdf\ufffd\b wP\ufffd\ufffdg\ufffd\ufffdE\ufffd?\ufffd\ufffdNL\u0005\ufffd\ufffd\b\ufffd%$\u001b\ufffd\u00c5\ufffd\u0614ci\u0003\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdz:\ufffdN\ufffd\u0006\u001eX\ufffd=\ufffd\ufffd\ufffd\ufffd5\ufffdJ\u028b\ufffd\ufffd|su\ufffdf\ufffd\b wP\ufffd\ufffdg\ufffd\ufffdE\ufffd?\ufffd\ufffdNL\u0005\ufffd\ufffd\b\ufffd%$\u001b\ufffd\u00c5\ufffd\u0614ci\u0003\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 ~IC*\ufffd\r",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdz:\ufffdN\ufffd\u0006\u001eX\ufffd=\ufffd\ufffd\ufffd\ufffd5\ufffdJ\u028b\ufffd\ufffd|su\ufffdf\ufffd\b wP\ufffd\ufffdg\ufffd\ufffdE\ufffd?\ufffd\ufffdNL\u0005\ufffd\ufffd\b\ufffd%$\u001b\ufffd\u00c5\ufffd\u0614ci\u0003\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6c3c388d183fa27e63799d429847e04dc7ebfb8c",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdz:\ufffdN\ufffd\u0006\u001eX\ufffd=\ufffd\ufffd\ufffd\ufffd5\ufffdJ\u028b\ufffd\ufffd|su\ufffdf\ufffd\b wP\ufffd\ufffdg\ufffd\ufffdE\ufffd?\ufffd\ufffdNL\u0005\ufffd\ufffd\b\ufffd%$\u001b\ufffd\u00c5\ufffd\u0614ci\u0003\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdz:\ufffdN\ufffdX\ufffd=\ufffd\ufffd\ufffd\ufffd5\ufffdJ\u028b\ufffd\ufffd|su\ufffdf\ufffd wP\ufffd\ufffdg\ufffd\ufffdE\ufffd?\ufffd\ufffdNL\ufffd\ufffd\ufffd%$\ufffd\u00c5\ufffd\u0614ci$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffdz:\ufffdN\ufffd\u0006\u001eX\ufffd=\ufffd\ufffd\ufffd\ufffd5\ufffdJ\u028b\ufffd\ufffd|su\ufffdf\ufffd\b wP\ufffd\ufffdg\ufffd\ufffdE\ufffd?\ufffd\ufffdNL\u0005\ufffd\ufffd\b\ufffd%$\u001b\ufffd\u00c5\ufffd\u0614ci\u0003\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdz:\ufffdN\ufffdX\ufffd=\ufffd\ufffd\ufffd\ufffd5\ufffdJ\u028b\ufffd\ufffd|su\ufffdf\ufffd wP\ufffd\ufffdg\ufffd\ufffdE\ufffd?\ufffd\ufffdNL\ufffd\ufffd\ufffd%$\ufffd\u00c5\ufffd\u0614ci$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8831951337911046,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3d1dcdaf30383b1c1e905c25d3035db2",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Q\ufffd\ufffd\u001c\ufffd\u0018\ufffd\u0010\udb27\udf6bS\u000b\u0658'\ufffd\ufffd\ufffdg\ufffd<EG\ufffd\ufffdJ\ufffd \ufffdERL`\ufffd\ufffd\ufffd#sV\ufffdHs\ufffd\u0528\ufffd\ufffdd\ufffd\ufffdwQ\u0016#\u0001\ufffdR$\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Q\ufffd\ufffd\u001c\ufffd\u0018\ufffd\u0010\udb27\udf6bS\u000b\u0658'\ufffd\ufffd\ufffdg\ufffd<EG\ufffd\ufffdJ\ufffd \ufffdERL`\ufffd\ufffd\ufffd#sV\ufffdHs\ufffd\u0528\ufffd\ufffdd\ufffd\ufffdwQ\u0016#\u0001\ufffdR$\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0732\ufffd*]\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Q\ufffd\ufffd\u001c\ufffd\u0018\ufffd\u0010\udb27\udf6bS\u000b\u0658'\ufffd\ufffd\ufffdg\ufffd<EG\ufffd\ufffdJ\ufffd \ufffdERL`\ufffd\ufffd\ufffd#sV\ufffdHs\ufffd\u0528\ufffd\ufffdd\ufffd\ufffdwQ\u0016#\u0001\ufffdR$\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fa1ae1aeebda930a59e11b4ef887c9acf7afb851",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Q\ufffd\ufffd\u001c\ufffd\u0018\ufffd\u0010\udb27\udf6bS\u000b\u0658'\ufffd\ufffd\ufffdg\ufffd<EG\ufffd\ufffdJ\ufffd \ufffdERL`\ufffd\ufffd\ufffd#sV\ufffdHs\ufffd\u0528\ufffd\ufffdd\ufffd\ufffdwQ\u0016#\u0001\ufffdR$\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdQ\ufffd\ufffd\ufffd\ufffd\udb27\udf6bS\u0658'\ufffd\ufffd\ufffdg\ufffd<EG\ufffd\ufffdJ\ufffd \ufffdERL`\ufffd\ufffd\ufffd#sV\ufffdHs\ufffd\u0528\ufffd\ufffdd\ufffd\ufffdwQ#\ufffdR$\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Q\ufffd\ufffd\u001c\ufffd\u0018\ufffd\u0010\udb27\udf6bS\u000b\u0658'\ufffd\ufffd\ufffdg\ufffd<EG\ufffd\ufffdJ\ufffd \ufffdERL`\ufffd\ufffd\ufffd#sV\ufffdHs\ufffd\u0528\ufffd\ufffdd\ufffd\ufffdwQ\u0016#\u0001\ufffdR$\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdQ\ufffd\ufffd\ufffd\ufffd\udb27\udf6bS\u0658'\ufffd\ufffd\ufffdg\ufffd<EG\ufffd\ufffdJ\ufffd \ufffdERL`\ufffd\ufffd\ufffd#sV\ufffdHs\ufffd\u0528\ufffd\ufffdd\ufffd\ufffdwQ#\ufffdR$\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8726375380743243,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "362ffbc37b9fb80fc814c22e061e2361",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\u0016?\u0016)\ufffd\ufffd\ufffdZ\u0006\u0001W\ufffd\u0004\\&dG\u001f\u07f0\ufffdh\ufffd\ufffd\u001d\ufffd\rl\f y\ufffd\ufffd\ufffd\ufffd)\u0014%\ufffd\ufffd\ufffdS\u001e\ufffd>\ufffd\f\ufffd\u0010\ufffdP\ufffd\ufffd\u000b\ufffd\ufffd}\u0010\u00026\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\u0016?\u0016)\ufffd\ufffd\ufffdZ\u0006\u0001W\ufffd\u0004\\&dG\u001f\u07f0\ufffdh\ufffd\ufffd\u001d\ufffd\rl\f y\ufffd\ufffd\ufffd\ufffd)\u0014%\ufffd\ufffd\ufffdS\u001e\ufffd>\ufffd\f\ufffd\u0010\ufffdP\ufffd\ufffd\u000b\ufffd\ufffd}\u0010\u00026\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \"\ufffd\ufffd~\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\u0016?\u0016)\ufffd\ufffd\ufffdZ\u0006\u0001W\ufffd\u0004\\&dG\u001f\u07f0\ufffdh\ufffd\ufffd\u001d\ufffd\rl\f y\ufffd\ufffd\ufffd\ufffd)\u0014%\ufffd\ufffd\ufffdS\u001e\ufffd>\ufffd\f\ufffd\u0010\ufffdP\ufffd\ufffd\u000b\ufffd\ufffd}\u0010\u00026\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cd4f021f1f1f0119f283f94f347c97babba561be",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\u0016?\u0016)\ufffd\ufffd\ufffdZ\u0006\u0001W\ufffd\u0004\\&dG\u001f\u07f0\ufffdh\ufffd\ufffd\u001d\ufffd\rl\f y\ufffd\ufffd\ufffd\ufffd)\u0014%\ufffd\ufffd\ufffdS\u001e\ufffd>\ufffd\f\ufffd\u0010\ufffdP\ufffd\ufffd\u000b\ufffd\ufffd}\u0010\u00026\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffda?)\ufffd\ufffd\ufffdZW\ufffd\\&dG\u07f0\ufffdh\ufffd\ufffd\ufffd\rl y\ufffd\ufffd\ufffd\ufffd)%\ufffd\ufffd\ufffdS\ufffd>\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd}6$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\u0016?\u0016)\ufffd\ufffd\ufffdZ\u0006\u0001W\ufffd\u0004\\&dG\u001f\u07f0\ufffdh\ufffd\ufffd\u001d\ufffd\rl\f y\ufffd\ufffd\ufffd\ufffd)\u0014%\ufffd\ufffd\ufffdS\u001e\ufffd>\ufffd\f\ufffd\u0010\ufffdP\ufffd\ufffd\u000b\ufffd\ufffd}\u0010\u00026\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffda?)\ufffd\ufffd\ufffdZW\ufffd\\&dG\u07f0\ufffdh\ufffd\ufffd\ufffd\rl y\ufffd\ufffd\ufffd\ufffd)%\ufffd\ufffd\ufffdS\ufffd>\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd}6$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8385685806321614,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "208c73fb73ee387bf6f12a7303507cdc",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003N\ufffd$|9-\ufffdqB\ufffd\ufffd\ufffd\ufffd:Y\ufffd\ufffd6s\u0013{:\ufffd\ufffd\u0320\ufffdT\ufffd\ufffd\u0005\ufffd \u0003\u0000\ufffd\u0006|t\u000fv\ufffd\u0018&\ufffdbJ\ufffd\u0015\ufffdb\ufffd\ufffdd\ufffd\u0011\ufffd\ufffd\u001c6\u0010\ufffdmK\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003N\ufffd$|9-\ufffdqB\ufffd\ufffd\ufffd\ufffd:Y\ufffd\ufffd6s\u0013{:\ufffd\ufffd\u0320\ufffdT\ufffd\ufffd\u0005\ufffd \u0003\u0000\ufffd\u0006|t\u000fv\ufffd\u0018&\ufffdbJ\ufffd\u0015\ufffdb\ufffd\ufffdd\ufffd\u0011\ufffd\ufffd\u001c6\u0010\ufffdmK\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd*x(\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003N\ufffd$|9-\ufffdqB\ufffd\ufffd\ufffd\ufffd:Y\ufffd\ufffd6s\u0013{:\ufffd\ufffd\u0320\ufffdT\ufffd\ufffd\u0005\ufffd \u0003\u0000\ufffd\u0006|t\u000fv\ufffd\u0018&\ufffdbJ\ufffd\u0015\ufffdb\ufffd\ufffdd\ufffd\u0011\ufffd\ufffd\u001c6\u0010\ufffdmK\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d803c8770c3dea41d3c88830c48a1e08a77ae170",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003N\ufffd$|9-\ufffdqB\ufffd\ufffd\ufffd\ufffd:Y\ufffd\ufffd6s\u0013{:\ufffd\ufffd\u0320\ufffdT\ufffd\ufffd\u0005\ufffd \u0003\u0000\ufffd\u0006|t\u000fv\ufffd\u0018&\ufffdbJ\ufffd\u0015\ufffdb\ufffd\ufffdd\ufffd\u0011\ufffd\ufffd\u001c6\u0010\ufffdmK\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdN\ufffd$|9-\ufffdqB\ufffd\ufffd\ufffd\ufffd:Y\ufffd\ufffd6s{:\ufffd\ufffd\u0320\ufffdT\ufffd\ufffd\ufffd \ufffd|tv\ufffd&\ufffdbJ\ufffd\ufffdb\ufffd\ufffdd\ufffd\ufffd\ufffd6\ufffdmK\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003N\ufffd$|9-\ufffdqB\ufffd\ufffd\ufffd\ufffd:Y\ufffd\ufffd6s\u0013{:\ufffd\ufffd\u0320\ufffdT\ufffd\ufffd\u0005\ufffd \u0003\u0000\ufffd\u0006|t\u000fv\ufffd\u0018&\ufffdbJ\ufffd\u0015\ufffdb\ufffd\ufffdd\ufffd\u0011\ufffd\ufffd\u001c6\u0010\ufffdmK\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdN\ufffd$|9-\ufffdqB\ufffd\ufffd\ufffd\ufffd:Y\ufffd\ufffd6s{:\ufffd\ufffd\u0320\ufffdT\ufffd\ufffd\ufffd \ufffd|tv\ufffd&\ufffdbJ\ufffd\ufffdb\ufffd\ufffdd\ufffd\ufffd\ufffd6\ufffdmK\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8831191858288583,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8eadced215e7aef2dab9dffc241c57e9",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030l\u001d\ufffd\ufffd=\u001b<d\ufffd\ufffd\ufffd\u00100\ufffd\ufffd\u0018\u05c4U\u0626\u0013\u0017\ufffdm\ufffd\ufffd5\ufffd\u001c\ufffd \ufffdu\ufffdBL\ufffd'\u001d88\ufffd\ufffdW\ufffdZ\"@\ufffd\ufffdl\ufffdm\ufffd\ufffdI\t\u0014*\ufffd8\u0014\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030l\u001d\ufffd\ufffd=\u001b<d\ufffd\ufffd\ufffd\u00100\ufffd\ufffd\u0018\u05c4U\u0626\u0013\u0017\ufffdm\ufffd\ufffd5\ufffd\u001c\ufffd \ufffdu\ufffdBL\ufffd'\u001d88\ufffd\ufffdW\ufffdZ\"@\ufffd\ufffdl\ufffdm\ufffd\ufffdI\t\u0014*\ufffd8\u0014\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0012\u0001g\ufffd\u001c",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030l\u001d\ufffd\ufffd=\u001b<d\ufffd\ufffd\ufffd\u00100\ufffd\ufffd\u0018\u05c4U\u0626\u0013\u0017\ufffdm\ufffd\ufffd5\ufffd\u001c\ufffd \ufffdu\ufffdBL\ufffd'\u001d88\ufffd\ufffdW\ufffdZ\"@\ufffd\ufffdl\ufffdm\ufffd\ufffdI\t\u0014*\ufffd8\u0014\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "16ef9ff1a64728b3d70a8302252d19cd657bab3b",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030l\u001d\ufffd\ufffd=\u001b<d\ufffd\ufffd\ufffd\u00100\ufffd\ufffd\u0018\u05c4U\u0626\u0013\u0017\ufffdm\ufffd\ufffd5\ufffd\u001c\ufffd \ufffdu\ufffdBL\ufffd'\u001d88\ufffd\ufffdW\ufffdZ\"@\ufffd\ufffdl\ufffdm\ufffd\ufffdI\t\u0014*\ufffd8\u0014\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd0l\ufffd\ufffd=<d\ufffd\ufffd\ufffd0\ufffd\ufffd\u05c4U\u0626\ufffdm\ufffd\ufffd5\ufffd\ufffd \ufffdu\ufffdBL\ufffd'88\ufffd\ufffdW\ufffdZ\"@\ufffd\ufffdl\ufffdm\ufffd\ufffdI\t*\ufffd8\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00030l\u001d\ufffd\ufffd=\u001b<d\ufffd\ufffd\ufffd\u00100\ufffd\ufffd\u0018\u05c4U\u0626\u0013\u0017\ufffdm\ufffd\ufffd5\ufffd\u001c\ufffd \ufffdu\ufffdBL\ufffd'\u001d88\ufffd\ufffdW\ufffdZ\"@\ufffd\ufffdl\ufffdm\ufffd\ufffdI\t\u0014*\ufffd8\u0014\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd0l\ufffd\ufffd=<d\ufffd\ufffd\ufffd0\ufffd\ufffd\u05c4U\u0626\ufffdm\ufffd\ufffd5\ufffd\ufffd \ufffdu\ufffdBL\ufffd'88\ufffd\ufffdW\ufffdZ\"@\ufffd\ufffdl\ufffdm\ufffd\ufffdI\t*\ufffd8\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.847368952029358,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1c42fc1c3f32f857b71be35513c5aa85",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003B~\ufffd\ufffd\ufffdSR=\ufffd\ufffd\ufffd\ufffd\u0018\b\ufffd\u00110\ufffdk\ufffd\ufffd\u0013\u0005\ufffd$r!\ufffd\u001drBh \ufffd\ufffd\u0004\ufffd\rv\u0004\ufffd#\ufffd.\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffd*\ufffd\u0000\ufffd\u0016\u001d\ufffd]\ufffdD\ufffd\ufffd)Q\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003B~\ufffd\ufffd\ufffdSR=\ufffd\ufffd\ufffd\ufffd\u0018\b\ufffd\u00110\ufffdk\ufffd\ufffd\u0013\u0005\ufffd$r!\ufffd\u001drBh \ufffd\ufffd\u0004\ufffd\rv\u0004\ufffd#\ufffd.\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffd*\ufffd\u0000\ufffd\u0016\u001d\ufffd]\ufffdD\ufffd\ufffd)Q\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 ?b\ufffd%\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003B~\ufffd\ufffd\ufffdSR=\ufffd\ufffd\ufffd\ufffd\u0018\b\ufffd\u00110\ufffdk\ufffd\ufffd\u0013\u0005\ufffd$r!\ufffd\u001drBh \ufffd\ufffd\u0004\ufffd\rv\u0004\ufffd#\ufffd.\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffd*\ufffd\u0000\ufffd\u0016\u001d\ufffd]\ufffdD\ufffd\ufffd)Q\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a694e401a5b1b1ae1083642be61ff4b7e2a17bc6",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003B~\ufffd\ufffd\ufffdSR=\ufffd\ufffd\ufffd\ufffd\u0018\b\ufffd\u00110\ufffdk\ufffd\ufffd\u0013\u0005\ufffd$r!\ufffd\u001drBh \ufffd\ufffd\u0004\ufffd\rv\u0004\ufffd#\ufffd.\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffd*\ufffd\u0000\ufffd\u0016\u001d\ufffd]\ufffdD\ufffd\ufffd)Q\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdB~\ufffd\ufffd\ufffdSR=\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffdk\ufffd\ufffd\ufffd$r!\ufffdrBh \ufffd\ufffd\ufffd\rv\ufffd#\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd]\ufffdD\ufffd\ufffd)Q$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003B~\ufffd\ufffd\ufffdSR=\ufffd\ufffd\ufffd\ufffd\u0018\b\ufffd\u00110\ufffdk\ufffd\ufffd\u0013\u0005\ufffd$r!\ufffd\u001drBh \ufffd\ufffd\u0004\ufffd\rv\u0004\ufffd#\ufffd.\ufffd\ufffd\ufffd\ufffd\u000b\ufffd\ufffd*\ufffd\u0000\ufffd\u0016\u001d\ufffd]\ufffdD\ufffd\ufffd)Q\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdB~\ufffd\ufffd\ufffdSR=\ufffd\ufffd\ufffd\ufffd\ufffd0\ufffdk\ufffd\ufffd\ufffd$r!\ufffdrBh \ufffd\ufffd\ufffd\rv\ufffd#\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd\ufffd\ufffd]\ufffdD\ufffd\ufffd)Q$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8319326072477318,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "29c9e7648c3a81fedf92bf991896d1df",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"\u000b\u0000]\ufffd\ufffd!?bO\u001b(\ufffdlFS\ufffd\ufffd\ufffdr\ufffd\u0005@h\u52b4\ufffd%\b\u0011 Jb(*\ufffd\ufffd'c\u0013 \ufffd\ufffd\ufffdzp\ufffd\ufffd*x\ufffd\u000f\ufffd\u0001\ufffd\ufffd\u0486\ufffde\u0006\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"\u000b\u0000]\ufffd\ufffd!?bO\u001b(\ufffdlFS\ufffd\ufffd\ufffdr\ufffd\u0005@h\u52b4\ufffd%\b\u0011 Jb(*\ufffd\ufffd'c\u0013 \ufffd\ufffd\ufffdzp\ufffd\ufffd*x\ufffd\u000f\ufffd\u0001\ufffd\ufffd\u0486\ufffde\u0006\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffdF\ufffd>:",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"\u000b\u0000]\ufffd\ufffd!?bO\u001b(\ufffdlFS\ufffd\ufffd\ufffdr\ufffd\u0005@h\u52b4\ufffd%\b\u0011 Jb(*\ufffd\ufffd'c\u0013 \ufffd\ufffd\ufffdzp\ufffd\ufffd*x\ufffd\u000f\ufffd\u0001\ufffd\ufffd\u0486\ufffde\u0006\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "721126043f551f04554d2fdbf22bc18c1fc208f8",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"\u000b\u0000]\ufffd\ufffd!?bO\u001b(\ufffdlFS\ufffd\ufffd\ufffdr\ufffd\u0005@h\u52b4\ufffd%\b\u0011 Jb(*\ufffd\ufffd'c\u0013 \ufffd\ufffd\ufffdzp\ufffd\ufffd*x\ufffd\u000f\ufffd\u0001\ufffd\ufffd\u0486\ufffde\u0006\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\"]\ufffd\ufffd!?bO(\ufffdlFS\ufffd\ufffd\ufffdr\ufffd@h\u52b4\ufffd% Jb(*\ufffd\ufffd'c \ufffd\ufffd\ufffdzp\ufffd\ufffd*x\ufffd\ufffd\ufffd\ufffd\u0486\ufffde\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\"\u000b\u0000]\ufffd\ufffd!?bO\u001b(\ufffdlFS\ufffd\ufffd\ufffdr\ufffd\u0005@h\u52b4\ufffd%\b\u0011 Jb(*\ufffd\ufffd'c\u0013 \ufffd\ufffd\ufffdzp\ufffd\ufffd*x\ufffd\u000f\ufffd\u0001\ufffd\ufffd\u0486\ufffde\u0006\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\"]\ufffd\ufffd!?bO(\ufffdlFS\ufffd\ufffd\ufffdr\ufffd@h\u52b4\ufffd% Jb(*\ufffd\ufffd'c \ufffd\ufffd\ufffdzp\ufffd\ufffd*x\ufffd\ufffd\ufffd\ufffd\u0486\ufffde\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.9101841793468646,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ad4e7da4e6e21ee6e0a15dbfd8f9d255",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdP\ufffdy\ufffd7\ufffdn\ufffd\ufffd\ufffd!}\"\u047d-\u0299\ufffd\ufffdQ \u0012\r\ufffd\u0658+\ufffd\ufffd\ufffd\u001d\ufffd\ufffdh\ufffdV\"\ufffd\ufffd~\u001aU*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdP\ufffdy\ufffd7\ufffdn\ufffd\ufffd\ufffd!}\"\u047d-\u0299\ufffd\ufffdQ \u0012\r\ufffd\u0658+\ufffd\ufffd\ufffd\u001d\ufffd\ufffdh\ufffdV\"\ufffd\ufffd~\u001aU*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 M\u0014O%\ufffd%",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdP\ufffdy\ufffd7\ufffdn\ufffd\ufffd\ufffd!}\"\u047d-\u0299\ufffd\ufffdQ \u0012\r\ufffd\u0658+\ufffd\ufffd\ufffd\u001d\ufffd\ufffdh\ufffdV\"\ufffd\ufffd~\u001aU*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3f452f4d7dfd27526fa24ff544fb033ce054388d",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdP\ufffdy\ufffd7\ufffdn\ufffd\ufffd\ufffd!}\"\u047d-\u0299\ufffd\ufffdQ \u0012\r\ufffd\u0658+\ufffd\ufffd\ufffd\u001d\ufffd\ufffdh\ufffdV\"\ufffd\ufffd~\u001aU*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdP\ufffdy\ufffd7\ufffdn\ufffd\ufffd\ufffd!}\"\u047d-\u0299\ufffd\ufffdQ \r\ufffd\u0658+\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffdV\"\ufffd\ufffd~U*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdP\ufffdy\ufffd7\ufffdn\ufffd\ufffd\ufffd!}\"\u047d-\u0299\ufffd\ufffdQ \u0012\r\ufffd\u0658+\ufffd\ufffd\ufffd\u001d\ufffd\ufffdh\ufffdV\"\ufffd\ufffd~\u001aU*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdP\ufffdy\ufffd7\ufffdn\ufffd\ufffd\ufffd!}\"\u047d-\u0299\ufffd\ufffdQ \r\ufffd\u0658+\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffdV\"\ufffd\ufffd~U*\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.9008382484586592,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3ded04a4b2e44db4650aa2b68e48eca7",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdHZ\ufffdX&\ufffd\ufffd\ufffdvR\ufffd,\ufffd1\u001f\ufffd\ufffdS?\ufffdl\ufffd]\u0005\ufffd\u001c\ufffd\ufffd\u0018 \n\ufffd\ufffd0\ufffdxb^\ufffdV\ufffdnL\ufffd\u0003\ufffd\ufffd\ufffd\u0016`\ufffd\ufffdZ\ufffd\u0012\ufffd\ufffd\u0564\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdHZ\ufffdX&\ufffd\ufffd\ufffdvR\ufffd,\ufffd1\u001f\ufffd\ufffdS?\ufffdl\ufffd]\u0005\ufffd\u001c\ufffd\ufffd\u0018 \n\ufffd\ufffd0\ufffdxb^\ufffdV\ufffdnL\ufffd\u0003\ufffd\ufffd\ufffd\u0016`\ufffd\ufffdZ\ufffd\u0012\ufffd\ufffd\u0564\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 )5r\ufffd\u06cd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdHZ\ufffdX&\ufffd\ufffd\ufffdvR\ufffd,\ufffd1\u001f\ufffd\ufffdS?\ufffdl\ufffd]\u0005\ufffd\u001c\ufffd\ufffd\u0018 \n\ufffd\ufffd0\ufffdxb^\ufffdV\ufffdnL\ufffd\u0003\ufffd\ufffd\ufffd\u0016`\ufffd\ufffdZ\ufffd\u0012\ufffd\ufffd\u0564\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "76ce1b26e23167f484b54732952feedc3362fa9d",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdHZ\ufffdX&\ufffd\ufffd\ufffdvR\ufffd,\ufffd1\u001f\ufffd\ufffdS?\ufffdl\ufffd]\u0005\ufffd\u001c\ufffd\ufffd\u0018 \n\ufffd\ufffd0\ufffdxb^\ufffdV\ufffdnL\ufffd\u0003\ufffd\ufffd\ufffd\u0016`\ufffd\ufffdZ\ufffd\u0012\ufffd\ufffd\u0564\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdHZ\ufffdX&\ufffd\ufffd\ufffdvR\ufffd,\ufffd1\ufffd\ufffdS?\ufffdl\ufffd]\ufffd\ufffd\ufffd \n\ufffd\ufffd0\ufffdxb^\ufffdV\ufffdnL\ufffd\ufffd\ufffd\ufffd`\ufffd\ufffdZ\ufffd\ufffd\ufffd\u0564\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdHZ\ufffdX&\ufffd\ufffd\ufffdvR\ufffd,\ufffd1\u001f\ufffd\ufffdS?\ufffdl\ufffd]\u0005\ufffd\u001c\ufffd\ufffd\u0018 \n\ufffd\ufffd0\ufffdxb^\ufffdV\ufffdnL\ufffd\u0003\ufffd\ufffd\ufffd\u0016`\ufffd\ufffdZ\ufffd\u0012\ufffd\ufffd\u0564\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdHZ\ufffdX&\ufffd\ufffd\ufffdvR\ufffd,\ufffd1\ufffd\ufffdS?\ufffdl\ufffd]\ufffd\ufffd\ufffd \n\ufffd\ufffd0\ufffdxb^\ufffdV\ufffdnL\ufffd\ufffd\ufffd\ufffd`\ufffd\ufffdZ\ufffd\ufffd\ufffd\u0564\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.868704791652365,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e39a1b805c38dcb1f602607d41de92c9",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003bP4\ufffd3\ufffd\ufffd\u0014\ufffdzA\/\ufffd\ufffd\/\ufffdI\ufffd\ufffd5\ufffd\ufffd\u000b\ufffd\"<}1\u0335\ufffd \u0302\ufffdy{I\ufffd}'\u0002\u0010\ufffd\ufffd\u0007(\ufffd\nR]];\ufffd\ufffd\u0010nU\ufffdP\ufffd\ufffd\ufffd2\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003bP4\ufffd3\ufffd\ufffd\u0014\ufffdzA\/\ufffd\ufffd\/\ufffdI\ufffd\ufffd5\ufffd\ufffd\u000b\ufffd\"<}1\u0335\ufffd \u0302\ufffdy{I\ufffd}'\u0002\u0010\ufffd\ufffd\u0007(\ufffd\nR]];\ufffd\ufffd\u0010nU\ufffdP\ufffd\ufffd\ufffd2\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 2\ufffd~\ufffd\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003bP4\ufffd3\ufffd\ufffd\u0014\ufffdzA\/\ufffd\ufffd\/\ufffdI\ufffd\ufffd5\ufffd\ufffd\u000b\ufffd\"<}1\u0335\ufffd \u0302\ufffdy{I\ufffd}'\u0002\u0010\ufffd\ufffd\u0007(\ufffd\nR]];\ufffd\ufffd\u0010nU\ufffdP\ufffd\ufffd\ufffd2\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4e66cfdd680dd078a95e5e90afb4be18a1a79572",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003bP4\ufffd3\ufffd\ufffd\u0014\ufffdzA\/\ufffd\ufffd\/\ufffdI\ufffd\ufffd5\ufffd\ufffd\u000b\ufffd\"<}1\u0335\ufffd \u0302\ufffdy{I\ufffd}'\u0002\u0010\ufffd\ufffd\u0007(\ufffd\nR]];\ufffd\ufffd\u0010nU\ufffdP\ufffd\ufffd\ufffd2\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdbP4\ufffd3\ufffd\ufffd\ufffdzA\/\ufffd\ufffd\/\ufffdI\ufffd\ufffd5\ufffd\ufffd\ufffd\"<}1\u0335\ufffd \u0302\ufffdy{I\ufffd}'\ufffd\ufffd(\ufffd\nR]];\ufffd\ufffdnU\ufffdP\ufffd\ufffd\ufffd2$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003bP4\ufffd3\ufffd\ufffd\u0014\ufffdzA\/\ufffd\ufffd\/\ufffdI\ufffd\ufffd5\ufffd\ufffd\u000b\ufffd\"<}1\u0335\ufffd \u0302\ufffdy{I\ufffd}'\u0002\u0010\ufffd\ufffd\u0007(\ufffd\nR]];\ufffd\ufffd\u0010nU\ufffdP\ufffd\ufffd\ufffd2\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdbP4\ufffd3\ufffd\ufffd\ufffdzA\/\ufffd\ufffd\/\ufffdI\ufffd\ufffd5\ufffd\ufffd\ufffd\"<}1\u0335\ufffd \u0302\ufffdy{I\ufffd}'\ufffd\ufffd(\ufffd\nR]];\ufffd\ufffdnU\ufffdP\ufffd\ufffd\ufffd2$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8508137175482986,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "94be40e4fc9d231cfaed230378a3da00",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0015\u000e\u0007B\ufffd\ufffd \u0002\ufffd\ufffd,\ufffd\u001d(=Y\ufffd<\u0526\ufffd\u01c0\ufffd^\ufffd\ufffd\u0003\ufffdY\ufffd \ufffd\u0006g@\ufffdp\ufffd\u0004\ufffd\ufffdX\ufffd4\ufffd\ufffd\u0000\ufffd}k\ufffdSX\ufffd\\\ufffd\ufffdP\ufffd{\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0015\u000e\u0007B\ufffd\ufffd \u0002\ufffd\ufffd,\ufffd\u001d(=Y\ufffd<\u0526\ufffd\u01c0\ufffd^\ufffd\ufffd\u0003\ufffdY\ufffd \ufffd\u0006g@\ufffdp\ufffd\u0004\ufffd\ufffdX\ufffd4\ufffd\ufffd\u0000\ufffd}k\ufffdSX\ufffd\\\ufffd\ufffdP\ufffd{\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0423\ufffd\u0016\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0015\u000e\u0007B\ufffd\ufffd \u0002\ufffd\ufffd,\ufffd\u001d(=Y\ufffd<\u0526\ufffd\u01c0\ufffd^\ufffd\ufffd\u0003\ufffdY\ufffd \ufffd\u0006g@\ufffdp\ufffd\u0004\ufffd\ufffdX\ufffd4\ufffd\ufffd\u0000\ufffd}k\ufffdSX\ufffd\\\ufffd\ufffdP\ufffd{\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b49a04934b23726edeb51e84fec72bfb5e0022cf",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0015\u000e\u0007B\ufffd\ufffd \u0002\ufffd\ufffd,\ufffd\u001d(=Y\ufffd<\u0526\ufffd\u01c0\ufffd^\ufffd\ufffd\u0003\ufffdY\ufffd \ufffd\u0006g@\ufffdp\ufffd\u0004\ufffd\ufffdX\ufffd4\ufffd\ufffd\u0000\ufffd}k\ufffdSX\ufffd\\\ufffd\ufffdP\ufffd{\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdB\ufffd\ufffd \ufffd\ufffd,\ufffd(=Y\ufffd<\u0526\ufffd\u01c0\ufffd^\ufffd\ufffd\ufffdY\ufffd \ufffdg@\ufffdp\ufffd\ufffd\ufffdX\ufffd4\ufffd\ufffd\ufffd}k\ufffdSX\ufffd\\\ufffd\ufffdP\ufffd{\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0015\u000e\u0007B\ufffd\ufffd \u0002\ufffd\ufffd,\ufffd\u001d(=Y\ufffd<\u0526\ufffd\u01c0\ufffd^\ufffd\ufffd\u0003\ufffdY\ufffd \ufffd\u0006g@\ufffdp\ufffd\u0004\ufffd\ufffdX\ufffd4\ufffd\ufffd\u0000\ufffd}k\ufffdSX\ufffd\\\ufffd\ufffdP\ufffd{\ufffd\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdB\ufffd\ufffd \ufffd\ufffd,\ufffd(=Y\ufffd<\u0526\ufffd\u01c0\ufffd^\ufffd\ufffd\ufffdY\ufffd \ufffdg@\ufffdp\ufffd\ufffd\ufffdX\ufffd4\ufffd\ufffd\ufffd}k\ufffdSX\ufffd\\\ufffd\ufffdP\ufffd{\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8554240014739247,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "324f4c9e04be1a1105037c9b98117081",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00c1A\ufffd\ufffd\ufffdu`\u07c7\u0010\ufffd\ufffd\ufffd\ufffdRt$L\ufffd\u0003\ufffda\r<\ufffd\ufffd\u0001N\ufffdq \ufffd\u001b!\r\ufffdP\ufffd\ufffd\ufffd\u02c1q\ufffdH\b\ufffd\ufffd\ufffd|\ufffd\ufffd\u0005~\ufffdw\ufffd\ufffd\ufffd\u07e0\u0002\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00c1A\ufffd\ufffd\ufffdu`\u07c7\u0010\ufffd\ufffd\ufffd\ufffdRt$L\ufffd\u0003\ufffda\r<\ufffd\ufffd\u0001N\ufffdq \ufffd\u001b!\r\ufffdP\ufffd\ufffd\ufffd\u02c1q\ufffdH\b\ufffd\ufffd\ufffd|\ufffd\ufffd\u0005~\ufffdw\ufffd\ufffd\ufffd\u07e0\u0002\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001f\ufffdWR\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00c1A\ufffd\ufffd\ufffdu`\u07c7\u0010\ufffd\ufffd\ufffd\ufffdRt$L\ufffd\u0003\ufffda\r<\ufffd\ufffd\u0001N\ufffdq \ufffd\u001b!\r\ufffdP\ufffd\ufffd\ufffd\u02c1q\ufffdH\b\ufffd\ufffd\ufffd|\ufffd\ufffd\u0005~\ufffdw\ufffd\ufffd\ufffd\u07e0\u0002\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6f351fdca4e5dd4d0311dfd9394dd46cc191731b",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00c1A\ufffd\ufffd\ufffdu`\u07c7\u0010\ufffd\ufffd\ufffd\ufffdRt$L\ufffd\u0003\ufffda\r<\ufffd\ufffd\u0001N\ufffdq \ufffd\u001b!\r\ufffdP\ufffd\ufffd\ufffd\u02c1q\ufffdH\b\ufffd\ufffd\ufffd|\ufffd\ufffd\u0005~\ufffdw\ufffd\ufffd\ufffd\u07e0\u0002\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\u00c1A\ufffd\ufffd\ufffdu`\u07c7\ufffd\ufffd\ufffd\ufffdRt$L\ufffd\ufffda\r<\ufffd\ufffdN\ufffdq \ufffd!\r\ufffdP\ufffd\ufffd\ufffd\u02c1q\ufffdH\ufffd\ufffd\ufffd|\ufffd\ufffd~\ufffdw\ufffd\ufffd\ufffd\u07e0\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u00c1A\ufffd\ufffd\ufffdu`\u07c7\u0010\ufffd\ufffd\ufffd\ufffdRt$L\ufffd\u0003\ufffda\r<\ufffd\ufffd\u0001N\ufffdq \ufffd\u001b!\r\ufffdP\ufffd\ufffd\ufffd\u02c1q\ufffdH\b\ufffd\ufffd\ufffd|\ufffd\ufffd\u0005~\ufffdw\ufffd\ufffd\ufffd\u07e0\u0002\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\u00c1A\ufffd\ufffd\ufffdu`\u07c7\ufffd\ufffd\ufffd\ufffdRt$L\ufffd\ufffda\r<\ufffd\ufffdN\ufffdq \ufffd!\r\ufffdP\ufffd\ufffd\ufffd\u02c1q\ufffdH\ufffd\ufffd\ufffd|\ufffd\ufffd~\ufffdw\ufffd\ufffd\ufffd\u07e0\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.891646831328541,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d649db5490d0533713e46ccf51c908af",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd98\u0013z\ufffdXmC\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffdJ\ufffd\\\ufffd\ufffd:E\ufffdX\ufffd\ufffd' \ufffd\ufffdB\ufffd]\ufffdON+%\u000e\u001b\u0756LR+?\ufffde\ufffd\ufffd\u000e\ufffd\u4f82x\ufffd?\ufffd\n\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd98\u0013z\ufffdXmC\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffdJ\ufffd\\\ufffd\ufffd:E\ufffdX\ufffd\ufffd' \ufffd\ufffdB\ufffd]\ufffdON+%\u000e\u001b\u0756LR+?\ufffde\ufffd\ufffd\u000e\ufffd\u4f82x\ufffd?\ufffd\n\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 t\ufffd\ufffd\ufffdm\u0017",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd98\u0013z\ufffdXmC\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffdJ\ufffd\\\ufffd\ufffd:E\ufffdX\ufffd\ufffd' \ufffd\ufffdB\ufffd]\ufffdON+%\u000e\u001b\u0756LR+?\ufffde\ufffd\ufffd\u000e\ufffd\u4f82x\ufffd?\ufffd\n\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2dd01b4ee53c48a109cb609c5eb56b06d9a4c50f",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd98\u0013z\ufffdXmC\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffdJ\ufffd\\\ufffd\ufffd:E\ufffdX\ufffd\ufffd' \ufffd\ufffdB\ufffd]\ufffdON+%\u000e\u001b\u0756LR+?\ufffde\ufffd\ufffd\u000e\ufffd\u4f82x\ufffd?\ufffd\n\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd98z\ufffdXmC\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\\\ufffd\ufffd:E\ufffdX\ufffd\ufffd' \ufffd\ufffdB\ufffd]\ufffdON+%\u0756LR+?\ufffde\ufffd\ufffd\ufffd\u4f82x\ufffd?\ufffd\n$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd98\u0013z\ufffdXmC\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffdJ\ufffd\\\ufffd\ufffd:E\ufffdX\ufffd\ufffd' \ufffd\ufffdB\ufffd]\ufffdON+%\u000e\u001b\u0756LR+?\ufffde\ufffd\ufffd\u000e\ufffd\u4f82x\ufffd?\ufffd\n\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd98z\ufffdXmC\ufffdH\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdJ\ufffd\\\ufffd\ufffd:E\ufffdX\ufffd\ufffd' \ufffd\ufffdB\ufffd]\ufffdON+%\u0756LR+?\ufffde\ufffd\ufffd\ufffd\u4f82x\ufffd?\ufffd\n$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8786891491242548,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e0e5b6697881288d1df141c6912889bf",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001d0I\u001b\ufffd*\ufffd\ufffdu\ufffdo_\u0001t\ufffd\ufffdN\ufffdK\/m\ufffd{\ufffdWkA1n\ufffd\ufffd tM\ufffdfX8\ufffd\ufffddf\ufffd:\ufffd\u0007\u0010\ufffd(\ufffdb+'!U\ufffd>\u0007;4\ufffd\\\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001d0I\u001b\ufffd*\ufffd\ufffdu\ufffdo_\u0001t\ufffd\ufffdN\ufffdK\/m\ufffd{\ufffdWkA1n\ufffd\ufffd tM\ufffdfX8\ufffd\ufffddf\ufffd:\ufffd\u0007\u0010\ufffd(\ufffdb+'!U\ufffd>\u0007;4\ufffd\\\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u05c9x\u001b\u054c",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001d0I\u001b\ufffd*\ufffd\ufffdu\ufffdo_\u0001t\ufffd\ufffdN\ufffdK\/m\ufffd{\ufffdWkA1n\ufffd\ufffd tM\ufffdfX8\ufffd\ufffddf\ufffd:\ufffd\u0007\u0010\ufffd(\ufffdb+'!U\ufffd>\u0007;4\ufffd\\\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0b893b0610e97d828f4e9564dbf25b199609bee1",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001d0I\u001b\ufffd*\ufffd\ufffdu\ufffdo_\u0001t\ufffd\ufffdN\ufffdK\/m\ufffd{\ufffdWkA1n\ufffd\ufffd tM\ufffdfX8\ufffd\ufffddf\ufffd:\ufffd\u0007\u0010\ufffd(\ufffdb+'!U\ufffd>\u0007;4\ufffd\\\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd0I\ufffd*\ufffd\ufffdu\ufffdo_t\ufffd\ufffdN\ufffdK\/m\ufffd{\ufffdWkA1n\ufffd\ufffd tM\ufffdfX8\ufffd\ufffddf\ufffd:\ufffd\ufffd(\ufffdb+'!U\ufffd>;4\ufffd\\\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001d0I\u001b\ufffd*\ufffd\ufffdu\ufffdo_\u0001t\ufffd\ufffdN\ufffdK\/m\ufffd{\ufffdWkA1n\ufffd\ufffd tM\ufffdfX8\ufffd\ufffddf\ufffd:\ufffd\u0007\u0010\ufffd(\ufffdb+'!U\ufffd>\u0007;4\ufffd\\\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd0I\ufffd*\ufffd\ufffdu\ufffdo_t\ufffd\ufffdN\ufffdK\/m\ufffd{\ufffdWkA1n\ufffd\ufffd tM\ufffdfX8\ufffd\ufffddf\ufffd:\ufffd\ufffd(\ufffdb+'!U\ufffd>;4\ufffd\\\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.901521501406049,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "470d9d5aa1b0106a9c39aee2e9274194",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\u0000a>\ufffd\ufffd\ufffd\u000e\ufffdI\ufffdd\ufffd\u000e\ufffd0\ufffd\ufffd3;\ufffd\u001e[\ufffd\ufffd \ufffdp\ufffd|\ufffd=\ufffd\"\ufffd\ufffd62,L\ufffdh\ufffd)\ufffd\u001b{\u0014\ufffdGm-D\ufffd\ufffd.mr\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\u0000a>\ufffd\ufffd\ufffd\u000e\ufffdI\ufffdd\ufffd\u000e\ufffd0\ufffd\ufffd3;\ufffd\u001e[\ufffd\ufffd \ufffdp\ufffd|\ufffd=\ufffd\"\ufffd\ufffd62,L\ufffdh\ufffd)\ufffd\u001b{\u0014\ufffdGm-D\ufffd\ufffd.mr\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 g-\ufffdyC>",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\u0000a>\ufffd\ufffd\ufffd\u000e\ufffdI\ufffdd\ufffd\u000e\ufffd0\ufffd\ufffd3;\ufffd\u001e[\ufffd\ufffd \ufffdp\ufffd|\ufffd=\ufffd\"\ufffd\ufffd62,L\ufffdh\ufffd)\ufffd\u001b{\u0014\ufffdGm-D\ufffd\ufffd.mr\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "96dae271c44d2f4bde7cb4409f9c89683326346b",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\u0000a>\ufffd\ufffd\ufffd\u000e\ufffdI\ufffdd\ufffd\u000e\ufffd0\ufffd\ufffd3;\ufffd\u001e[\ufffd\ufffd \ufffdp\ufffd|\ufffd=\ufffd\"\ufffd\ufffd62,L\ufffdh\ufffd)\ufffd\u001b{\u0014\ufffdGm-D\ufffd\ufffd.mr\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda>\ufffd\ufffd\ufffd\ufffdI\ufffdd\ufffd\ufffd0\ufffd\ufffd3;\ufffd[\ufffd\ufffd \ufffdp\ufffd|\ufffd=\ufffd\"\ufffd\ufffd62,L\ufffdh\ufffd)\ufffd{\ufffdGm-D\ufffd\ufffd.mr$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0006\ufffd\ufffd\u0000a>\ufffd\ufffd\ufffd\u000e\ufffdI\ufffdd\ufffd\u000e\ufffd0\ufffd\ufffd3;\ufffd\u001e[\ufffd\ufffd \ufffdp\ufffd|\ufffd=\ufffd\"\ufffd\ufffd62,L\ufffdh\ufffd)\ufffd\u001b{\u0014\ufffdGm-D\ufffd\ufffd.mr\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffda>\ufffd\ufffd\ufffd\ufffdI\ufffdd\ufffd\ufffd0\ufffd\ufffd3;\ufffd[\ufffd\ufffd \ufffdp\ufffd|\ufffd=\ufffd\"\ufffd\ufffd62,L\ufffdh\ufffd)\ufffd{\ufffdGm-D\ufffd\ufffd.mr$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.914564571042203,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "98efade618d5d0310d7f049a8dd88b79",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\ufffd\ufffdD\ufffd\ufffd\u05e2\ufffd\ufffd\ufffdAe%'\ufffd\ufffdM&\ufffd\ufffd\u01fdO\ufffd[\ufffd\ufffd\u0781\ufffd) B\ufffd\ufffd\ufffd\ufffdz\ufffd\u0012M\u0013\u026f\u0011\u009b\u07a2\ufffdbnKR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\ufffd\ufffdD\ufffd\ufffd\u05e2\ufffd\ufffd\ufffdAe%'\ufffd\ufffdM&\ufffd\ufffd\u01fdO\ufffd[\ufffd\ufffd\u0781\ufffd) B\ufffd\ufffd\ufffd\ufffdz\ufffd\u0012M\u0013\u026f\u0011\u009b\u07a2\ufffdbnKR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 }\ufffd4\ufffdc\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\ufffd\ufffdD\ufffd\ufffd\u05e2\ufffd\ufffd\ufffdAe%'\ufffd\ufffdM&\ufffd\ufffd\u01fdO\ufffd[\ufffd\ufffd\u0781\ufffd) B\ufffd\ufffd\ufffd\ufffdz\ufffd\u0012M\u0013\u026f\u0011\u009b\u07a2\ufffdbnKR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "85bc23c9c1cd504de030f4ba0f22160134b20d02",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\ufffd\ufffdD\ufffd\ufffd\u05e2\ufffd\ufffd\ufffdAe%'\ufffd\ufffdM&\ufffd\ufffd\u01fdO\ufffd[\ufffd\ufffd\u0781\ufffd) B\ufffd\ufffd\ufffd\ufffdz\ufffd\u0012M\u0013\u026f\u0011\u009b\u07a2\ufffdbnKR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffda\ufffd\ufffdD\ufffd\ufffd\u05e2\ufffd\ufffd\ufffdAe%'\ufffd\ufffdM&\ufffd\ufffd\u01fdO\ufffd[\ufffd\ufffd\u0781\ufffd) B\ufffd\ufffd\ufffd\ufffdz\ufffdM\u026f\u009b\u07a2\ufffdbnKR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003a\ufffd\ufffdD\ufffd\ufffd\u05e2\ufffd\ufffd\ufffdAe%'\ufffd\ufffdM&\ufffd\ufffd\u01fdO\ufffd[\ufffd\ufffd\u0781\ufffd) B\ufffd\ufffd\ufffd\ufffdz\ufffd\u0012M\u0013\u026f\u0011\u009b\u07a2\ufffdbnKR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffda\ufffd\ufffdD\ufffd\ufffd\u05e2\ufffd\ufffd\ufffdAe%'\ufffd\ufffdM&\ufffd\ufffd\u01fdO\ufffd[\ufffd\ufffd\u0781\ufffd) B\ufffd\ufffd\ufffd\ufffdz\ufffdM\u026f\u009b\u07a2\ufffdbnKR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8868680231014463,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "93b1203783aa4a18f327d28733dc83e5",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003;1[\ufffd\ufffd_L\ufffdt\ufffdJ{.\ufffd\ufffdC\\2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@H\u0000F\tL\ufffd oF\ufffd5B(\ufffdWM\ufffd\u0012-M\ufffd\u001c\ufffd\ufffd\u001c\ufffd\ufffd\n\ufffd\u000b\u0535\ufffdgp\ufffd4\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003;1[\ufffd\ufffd_L\ufffdt\ufffdJ{.\ufffd\ufffdC\\2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@H\u0000F\tL\ufffd oF\ufffd5B(\ufffdWM\ufffd\u0012-M\ufffd\u001c\ufffd\ufffd\u001c\ufffd\ufffd\n\ufffd\u000b\u0535\ufffdgp\ufffd4\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 +e%D\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003;1[\ufffd\ufffd_L\ufffdt\ufffdJ{.\ufffd\ufffdC\\2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@H\u0000F\tL\ufffd oF\ufffd5B(\ufffdWM\ufffd\u0012-M\ufffd\u001c\ufffd\ufffd\u001c\ufffd\ufffd\n\ufffd\u000b\u0535\ufffdgp\ufffd4\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5b2f160d0c3c844730f7607889fc9ef806b177a9",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003;1[\ufffd\ufffd_L\ufffdt\ufffdJ{.\ufffd\ufffdC\\2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@H\u0000F\tL\ufffd oF\ufffd5B(\ufffdWM\ufffd\u0012-M\ufffd\u001c\ufffd\ufffd\u001c\ufffd\ufffd\n\ufffd\u000b\u0535\ufffdgp\ufffd4\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd;1[\ufffd\ufffd_L\ufffdt\ufffdJ{.\ufffd\ufffdC\\2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@HF\tL\ufffd oF\ufffd5B(\ufffdWM\ufffd-M\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\u0535\ufffdgp\ufffd4$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003;1[\ufffd\ufffd_L\ufffdt\ufffdJ{.\ufffd\ufffdC\\2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@H\u0000F\tL\ufffd oF\ufffd5B(\ufffdWM\ufffd\u0012-M\ufffd\u001c\ufffd\ufffd\u001c\ufffd\ufffd\n\ufffd\u000b\u0535\ufffdgp\ufffd4\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd;1[\ufffd\ufffd_L\ufffdt\ufffdJ{.\ufffd\ufffdC\\2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@HF\tL\ufffd oF\ufffd5B(\ufffdWM\ufffd-M\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\u0535\ufffdgp\ufffd4$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.885881937728257,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4044bac84fb445e63e43f098632d5016",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003EL\ufffd\ufffd\u00d6\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdw3XC_c\u0507qz*\ufffd\ufffd.]F\u001f\ufffd \ufffd\ufffdB\u00108\ufffdj\u001a\ufffd\ufffd\ufffd>kw4\ufffd\ufffd\ufffd:~\u000b\ufffd\t<\ufffd\ufffdb|p\ufffd\ufffdh\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003EL\ufffd\ufffd\u00d6\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdw3XC_c\u0507qz*\ufffd\ufffd.]F\u001f\ufffd \ufffd\ufffdB\u00108\ufffdj\u001a\ufffd\ufffd\ufffd>kw4\ufffd\ufffd\ufffd:~\u000b\ufffd\t<\ufffd\ufffdb|p\ufffd\ufffdh\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u001c\ufffd\t@\ufffdK",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003EL\ufffd\ufffd\u00d6\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdw3XC_c\u0507qz*\ufffd\ufffd.]F\u001f\ufffd \ufffd\ufffdB\u00108\ufffdj\u001a\ufffd\ufffd\ufffd>kw4\ufffd\ufffd\ufffd:~\u000b\ufffd\t<\ufffd\ufffdb|p\ufffd\ufffdh\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "de6d7f5800095100a84e20e73bace910e314c10e",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003EL\ufffd\ufffd\u00d6\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdw3XC_c\u0507qz*\ufffd\ufffd.]F\u001f\ufffd \ufffd\ufffdB\u00108\ufffdj\u001a\ufffd\ufffd\ufffd>kw4\ufffd\ufffd\ufffd:~\u000b\ufffd\t<\ufffd\ufffdb|p\ufffd\ufffdh\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdEL\ufffd\ufffd\u00d6\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdw3XC_c\u0507qz*\ufffd\ufffd.]F\ufffd \ufffd\ufffdB8\ufffdj\ufffd\ufffd\ufffd>kw4\ufffd\ufffd\ufffd:~\ufffd\t<\ufffd\ufffdb|p\ufffd\ufffdh$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003EL\ufffd\ufffd\u00d6\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdw3XC_c\u0507qz*\ufffd\ufffd.]F\u001f\ufffd \ufffd\ufffdB\u00108\ufffdj\u001a\ufffd\ufffd\ufffd>kw4\ufffd\ufffd\ufffd:~\u000b\ufffd\t<\ufffd\ufffdb|p\ufffd\ufffdh\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdEL\ufffd\ufffd\u00d6\ufffd\ufffd\ufffd\ufffd\ufffdH\ufffd\ufffdw3XC_c\u0507qz*\ufffd\ufffd.]F\ufffd \ufffd\ufffdB8\ufffdj\ufffd\ufffd\ufffd>kw4\ufffd\ufffd\ufffd:~\ufffd\t<\ufffd\ufffdb|p\ufffd\ufffdh$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8743087574289152,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2e572ace0403aa321d22adff60f157d8",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdhE\ufffdN\ufffd\n\ufffd\ufffd\ufffdl\ufffd,\ufffdc\u0010@\ufffd~\ufffd\u075a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP8'\ufffd 7\ufffd\ufffd\u000e\ufffd\ufffdCs\ufffd4\ufffd3\u0013\ufffd\u001f\ufffd\ufffdT\ufffdB\ufffd\ufffd\ufffd\ufffdx|d\ufffd\ufffd\u001f\ufffdb\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdhE\ufffdN\ufffd\n\ufffd\ufffd\ufffdl\ufffd,\ufffdc\u0010@\ufffd~\ufffd\u075a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP8'\ufffd 7\ufffd\ufffd\u000e\ufffd\ufffdCs\ufffd4\ufffd3\u0013\ufffd\u001f\ufffd\ufffdT\ufffdB\ufffd\ufffd\ufffd\ufffdx|d\ufffd\ufffd\u001f\ufffdb\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0001\u0018\ufffd\u0019f",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdhE\ufffdN\ufffd\n\ufffd\ufffd\ufffdl\ufffd,\ufffdc\u0010@\ufffd~\ufffd\u075a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP8'\ufffd 7\ufffd\ufffd\u000e\ufffd\ufffdCs\ufffd4\ufffd3\u0013\ufffd\u001f\ufffd\ufffdT\ufffdB\ufffd\ufffd\ufffd\ufffdx|d\ufffd\ufffd\u001f\ufffdb\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6a3c4ad1945630dd2c12b372aca7f2d6d5971583",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdhE\ufffdN\ufffd\n\ufffd\ufffd\ufffdl\ufffd,\ufffdc\u0010@\ufffd~\ufffd\u075a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP8'\ufffd 7\ufffd\ufffd\u000e\ufffd\ufffdCs\ufffd4\ufffd3\u0013\ufffd\u001f\ufffd\ufffdT\ufffdB\ufffd\ufffd\ufffd\ufffdx|d\ufffd\ufffd\u001f\ufffdb\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdhE\ufffdN\ufffd\n\ufffd\ufffd\ufffdl\ufffd,\ufffdc@\ufffd~\ufffd\u075a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP8'\ufffd 7\ufffd\ufffd\ufffd\ufffdCs\ufffd4\ufffd3\ufffd\ufffd\ufffdT\ufffdB\ufffd\ufffd\ufffd\ufffdx|d\ufffd\ufffd\ufffdb$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdhE\ufffdN\ufffd\n\ufffd\ufffd\ufffdl\ufffd,\ufffdc\u0010@\ufffd~\ufffd\u075a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP8'\ufffd 7\ufffd\ufffd\u000e\ufffd\ufffdCs\ufffd4\ufffd3\u0013\ufffd\u001f\ufffd\ufffdT\ufffdB\ufffd\ufffd\ufffd\ufffdx|d\ufffd\ufffd\u001f\ufffdb\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdhE\ufffdN\ufffd\n\ufffd\ufffd\ufffdl\ufffd,\ufffdc@\ufffd~\ufffd\u075a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP8'\ufffd 7\ufffd\ufffd\ufffd\ufffdCs\ufffd4\ufffd3\ufffd\ufffd\ufffdT\ufffdB\ufffd\ufffd\ufffd\ufffdx|d\ufffd\ufffd\ufffdb$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8870233119367352,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "07bdb03a9f8705145300345445a47396",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000b\u0010\ufffdH\ufffdK\ufffd\ufffd(\ufffd[\ufffd'\ufffdd\u0018\ufffdw\u04b0\ufffd\u0010\ufffd\ufffdm_~\u001fdAA \ufffd8\ufffd0\ufffd)\ufffdq\ufffd\ufffd\t:\u0004\ufffd,tw\ufffdBG\u0b57q9\ufffdlNW`\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000b\u0010\ufffdH\ufffdK\ufffd\ufffd(\ufffd[\ufffd'\ufffdd\u0018\ufffdw\u04b0\ufffd\u0010\ufffd\ufffdm_~\u001fdAA \ufffd8\ufffd0\ufffd)\ufffdq\ufffd\ufffd\t:\u0004\ufffd,tw\ufffdBG\u0b57q9\ufffdlNW`\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\ufffd\ufffd\ufffdg",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000b\u0010\ufffdH\ufffdK\ufffd\ufffd(\ufffd[\ufffd'\ufffdd\u0018\ufffdw\u04b0\ufffd\u0010\ufffd\ufffdm_~\u001fdAA \ufffd8\ufffd0\ufffd)\ufffdq\ufffd\ufffd\t:\u0004\ufffd,tw\ufffdBG\u0b57q9\ufffdlNW`\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c9fb5a5428df4bfd67e75251dffa9cf0474f3109",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000b\u0010\ufffdH\ufffdK\ufffd\ufffd(\ufffd[\ufffd'\ufffdd\u0018\ufffdw\u04b0\ufffd\u0010\ufffd\ufffdm_~\u001fdAA \ufffd8\ufffd0\ufffd)\ufffdq\ufffd\ufffd\t:\u0004\ufffd,tw\ufffdBG\u0b57q9\ufffdlNW`\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdH\ufffdK\ufffd\ufffd(\ufffd[\ufffd'\ufffdd\ufffdw\u04b0\ufffd\ufffd\ufffdm_~dAA \ufffd8\ufffd0\ufffd)\ufffdq\ufffd\ufffd\t:\ufffd,tw\ufffdBG\u0b57q9\ufffdlNW`\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u000b\u0010\ufffdH\ufffdK\ufffd\ufffd(\ufffd[\ufffd'\ufffdd\u0018\ufffdw\u04b0\ufffd\u0010\ufffd\ufffdm_~\u001fdAA \ufffd8\ufffd0\ufffd)\ufffdq\ufffd\ufffd\t:\u0004\ufffd,tw\ufffdBG\u0b57q9\ufffdlNW`\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffdH\ufffdK\ufffd\ufffd(\ufffd[\ufffd'\ufffdd\ufffdw\u04b0\ufffd\ufffd\ufffdm_~dAA \ufffd8\ufffd0\ufffd)\ufffdq\ufffd\ufffd\t:\ufffd,tw\ufffdBG\u0b57q9\ufffdlNW`\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.862469884375108,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "070f205ca0942cd676a2dea20d3ce62f",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd$\ufffd\ufffd\ufffd\n\u000b\ufffd\u0455\u0014\ufffd\ufffdN\ufffd\ufffd`hRL$\ufffdt\ufffd\ufffd9>\u0015\ufffd\u0004\ufffd\ufffd 4\ufffdD:@dg5<\ufffdj<\u0013\ufffd\u001f\ufffd\u0006m&(\u0017\ufffd,\ufffdn\ufffd\u001e*\u00067~\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd$\ufffd\ufffd\ufffd\n\u000b\ufffd\u0455\u0014\ufffd\ufffdN\ufffd\ufffd`hRL$\ufffdt\ufffd\ufffd9>\u0015\ufffd\u0004\ufffd\ufffd 4\ufffdD:@dg5<\ufffdj<\u0013\ufffd\u001f\ufffd\u0006m&(\u0017\ufffd,\ufffdn\ufffd\u001e*\u00067~\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffdf3\u0507\u001b",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd$\ufffd\ufffd\ufffd\n\u000b\ufffd\u0455\u0014\ufffd\ufffdN\ufffd\ufffd`hRL$\ufffdt\ufffd\ufffd9>\u0015\ufffd\u0004\ufffd\ufffd 4\ufffdD:@dg5<\ufffdj<\u0013\ufffd\u001f\ufffd\u0006m&(\u0017\ufffd,\ufffdn\ufffd\u001e*\u00067~\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d90db826e387419fcfbb4edb7cb96c47d49cbeef",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd$\ufffd\ufffd\ufffd\n\u000b\ufffd\u0455\u0014\ufffd\ufffdN\ufffd\ufffd`hRL$\ufffdt\ufffd\ufffd9>\u0015\ufffd\u0004\ufffd\ufffd 4\ufffdD:@dg5<\ufffdj<\u0013\ufffd\u001f\ufffd\u0006m&(\u0017\ufffd,\ufffdn\ufffd\u001e*\u00067~\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd$\ufffd\ufffd\ufffd\n\ufffd\u0455\ufffd\ufffdN\ufffd\ufffd`hRL$\ufffdt\ufffd\ufffd9>\ufffd\ufffd\ufffd 4\ufffdD:@dg5<\ufffdj<\ufffd\ufffdm&(\ufffd,\ufffdn\ufffd*7~\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd$\ufffd\ufffd\ufffd\n\u000b\ufffd\u0455\u0014\ufffd\ufffdN\ufffd\ufffd`hRL$\ufffdt\ufffd\ufffd9>\u0015\ufffd\u0004\ufffd\ufffd 4\ufffdD:@dg5<\ufffdj<\u0013\ufffd\u001f\ufffd\u0006m&(\u0017\ufffd,\ufffdn\ufffd\u001e*\u00067~\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd$\ufffd\ufffd\ufffd\n\ufffd\u0455\ufffd\ufffdN\ufffd\ufffd`hRL$\ufffdt\ufffd\ufffd9>\ufffd\ufffd\ufffd 4\ufffdD:@dg5<\ufffdj<\ufffd\ufffdm&(\ufffd,\ufffdn\ufffd*7~\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8453570127675976,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "dbe1e47d71e2c251c68630b64a531dd6",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e:\ufffd#\u001fZw\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdD\u00d8w\ufffd\ufffd\u001e V\ufffd\ufffd\u000eE\nB\ufffdc \ufffdl\ufffdt+\ufffd|T\ufffd!\u0007\u0001\u0004z[f\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd-\ufffdi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e:\ufffd#\u001fZw\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdD\u00d8w\ufffd\ufffd\u001e V\ufffd\ufffd\u000eE\nB\ufffdc \ufffdl\ufffdt+\ufffd|T\ufffd!\u0007\u0001\u0004z[f\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd-\ufffdi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 3E\ufffd\ufffd\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e:\ufffd#\u001fZw\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdD\u00d8w\ufffd\ufffd\u001e V\ufffd\ufffd\u000eE\nB\ufffdc \ufffdl\ufffdt+\ufffd|T\ufffd!\u0007\u0001\u0004z[f\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd-\ufffdi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "85471b3886cc9b38f89b5a240f34ac1b4093d3e7",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e:\ufffd#\u001fZw\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdD\u00d8w\ufffd\ufffd\u001e V\ufffd\ufffd\u000eE\nB\ufffdc \ufffdl\ufffdt+\ufffd|T\ufffd!\u0007\u0001\u0004z[f\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd-\ufffdi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd:\ufffd#Zw\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdD\u00d8w\ufffd\ufffd V\ufffd\ufffdE\nB\ufffdc \ufffdl\ufffdt+\ufffd|T\ufffd!z[f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd-\ufffdi\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001e:\ufffd#\u001fZw\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdD\u00d8w\ufffd\ufffd\u001e V\ufffd\ufffd\u000eE\nB\ufffdc \ufffdl\ufffdt+\ufffd|T\ufffd!\u0007\u0001\u0004z[f\ufffd\u0019\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd-\ufffdi\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd:\ufffd#Zw\ufffd\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdD\u00d8w\ufffd\ufffd V\ufffd\ufffdE\nB\ufffdc \ufffdl\ufffdt+\ufffd|T\ufffd!z[f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd-\ufffdi\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8540737901374564,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6856c9f17fd87d26a32f7bf0207a682e",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdL1\u0014\f\ufffd\ufffd\ufffd~\u07c2\ufffdM\ufffdq\u001dOH\ufffd\u001f4\ufffd\ufffd\u001b\ufffd\ufffdgLv\u00157 \ufffd\u0000G\ufffd\u0016\ufffd\"'K\ufffdsR\ufffdH\ufffd\ufffd6W\ufffd)\\\u0157I\ufffd*0\u0013\u0004nx\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdL1\u0014\f\ufffd\ufffd\ufffd~\u07c2\ufffdM\ufffdq\u001dOH\ufffd\u001f4\ufffd\ufffd\u001b\ufffd\ufffdgLv\u00157 \ufffd\u0000G\ufffd\u0016\ufffd\"'K\ufffdsR\ufffdH\ufffd\ufffd6W\ufffd)\\\u0157I\ufffd*0\u0013\u0004nx\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u06d7\ufffd\ufffd(!",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdL1\u0014\f\ufffd\ufffd\ufffd~\u07c2\ufffdM\ufffdq\u001dOH\ufffd\u001f4\ufffd\ufffd\u001b\ufffd\ufffdgLv\u00157 \ufffd\u0000G\ufffd\u0016\ufffd\"'K\ufffdsR\ufffdH\ufffd\ufffd6W\ufffd)\\\u0157I\ufffd*0\u0013\u0004nx\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0305a9eeff2c1e045ea2177aaa0caca6d5e4a5e5",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdL1\u0014\f\ufffd\ufffd\ufffd~\u07c2\ufffdM\ufffdq\u001dOH\ufffd\u001f4\ufffd\ufffd\u001b\ufffd\ufffdgLv\u00157 \ufffd\u0000G\ufffd\u0016\ufffd\"'K\ufffdsR\ufffdH\ufffd\ufffd6W\ufffd)\\\u0157I\ufffd*0\u0013\u0004nx\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdL1\ufffd\ufffd\ufffd~\u07c2\ufffdM\ufffdqOH\ufffd4\ufffd\ufffd\ufffd\ufffdgLv7 \ufffdG\ufffd\ufffd\"'K\ufffdsR\ufffdH\ufffd\ufffd6W\ufffd)\\\u0157I\ufffd*0nx\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdL1\u0014\f\ufffd\ufffd\ufffd~\u07c2\ufffdM\ufffdq\u001dOH\ufffd\u001f4\ufffd\ufffd\u001b\ufffd\ufffdgLv\u00157 \ufffd\u0000G\ufffd\u0016\ufffd\"'K\ufffdsR\ufffdH\ufffd\ufffd6W\ufffd)\\\u0157I\ufffd*0\u0013\u0004nx\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdL1\ufffd\ufffd\ufffd~\u07c2\ufffdM\ufffdqOH\ufffd4\ufffd\ufffd\ufffd\ufffdgLv7 \ufffdG\ufffd\ufffd\"'K\ufffdsR\ufffdH\ufffd\ufffd6W\ufffd)\\\u0157I\ufffd*0nx\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.889381689013861,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e89647f031d9e1c229ba97ebf7138ce8",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Uj\ufffd\u07afI`\u0721\ufffd=\ufffd\ufffd\u001e\ufffd\u01bb\ufffd>h&\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffdT\ufffd \u000b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011P\ufffd\u000e\ufffdA4\u0013\ufffd\ufffd#\ufffd\ufffd$\ufffd\ufffd\u01f9e\ufffd\ufffdrT\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Uj\ufffd\u07afI`\u0721\ufffd=\ufffd\ufffd\u001e\ufffd\u01bb\ufffd>h&\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffdT\ufffd \u000b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011P\ufffd\u000e\ufffdA4\u0013\ufffd\ufffd#\ufffd\ufffd$\ufffd\ufffd\u01f9e\ufffd\ufffdrT\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\u0018ONF_",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Uj\ufffd\u07afI`\u0721\ufffd=\ufffd\ufffd\u001e\ufffd\u01bb\ufffd>h&\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffdT\ufffd \u000b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011P\ufffd\u000e\ufffdA4\u0013\ufffd\ufffd#\ufffd\ufffd$\ufffd\ufffd\u01f9e\ufffd\ufffdrT\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7ff62c600e8cf615ac79a8040b28a3e856663338",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Uj\ufffd\u07afI`\u0721\ufffd=\ufffd\ufffd\u001e\ufffd\u01bb\ufffd>h&\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffdT\ufffd \u000b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011P\ufffd\u000e\ufffdA4\u0013\ufffd\ufffd#\ufffd\ufffd$\ufffd\ufffd\u01f9e\ufffd\ufffdrT\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffdUj\ufffd\u07afI`\u0721\ufffd=\ufffd\ufffd\ufffd\u01bb\ufffd>h&\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffdT\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffdA4\ufffd\ufffd#\ufffd\ufffd$\ufffd\ufffd\u01f9e\ufffd\ufffdrT\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003Uj\ufffd\u07afI`\u0721\ufffd=\ufffd\ufffd\u001e\ufffd\u01bb\ufffd>h&\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffdT\ufffd \u000b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011P\ufffd\u000e\ufffdA4\u0013\ufffd\ufffd#\ufffd\ufffd$\ufffd\ufffd\u01f9e\ufffd\ufffdrT\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdUj\ufffd\u07afI`\u0721\ufffd=\ufffd\ufffd\ufffd\u01bb\ufffd>h&\ufffd\ufffd<\ufffd\ufffd\ufffd\ufffdT\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffdA4\ufffd\ufffd#\ufffd\ufffd$\ufffd\ufffd\u01f9e\ufffd\ufffdrT\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8894708914608604,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5d12b9754f9617fb59999a4eef41c0e0",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdZ \u0017'\ufffdX\/\ufffdU\ufffdo\ufffdON\"e!\ufffd=\ufffdS\ufffdL\ufffdR\ufffd\ufffdy\u000e\ufffd \ufffd\ufffd\ufffd\b\ufffd~\ufffd;u\u001f\ufffd\ufffd\ufffd\u001a\ufffd{\ufffd\ufffdS\u058fX\ufffdY\ufffd\u0252\ufffd\f!\ufffdw\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdZ \u0017'\ufffdX\/\ufffdU\ufffdo\ufffdON\"e!\ufffd=\ufffdS\ufffdL\ufffdR\ufffd\ufffdy\u000e\ufffd \ufffd\ufffd\ufffd\b\ufffd~\ufffd;u\u001f\ufffd\ufffd\ufffd\u001a\ufffd{\ufffd\ufffdS\u058fX\ufffdY\ufffd\u0252\ufffd\f!\ufffdw\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 n\u05aa>=\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdZ \u0017'\ufffdX\/\ufffdU\ufffdo\ufffdON\"e!\ufffd=\ufffdS\ufffdL\ufffdR\ufffd\ufffdy\u000e\ufffd \ufffd\ufffd\ufffd\b\ufffd~\ufffd;u\u001f\ufffd\ufffd\ufffd\u001a\ufffd{\ufffd\ufffdS\u058fX\ufffdY\ufffd\u0252\ufffd\f!\ufffdw\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "279f5d92a24a22757ced9534bfb1e813ed6c248e",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdZ \u0017'\ufffdX\/\ufffdU\ufffdo\ufffdON\"e!\ufffd=\ufffdS\ufffdL\ufffdR\ufffd\ufffdy\u000e\ufffd \ufffd\ufffd\ufffd\b\ufffd~\ufffd;u\u001f\ufffd\ufffd\ufffd\u001a\ufffd{\ufffd\ufffdS\u058fX\ufffdY\ufffd\u0252\ufffd\f!\ufffdw\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdZ '\ufffdX\/\ufffdU\ufffdo\ufffdON\"e!\ufffd=\ufffdS\ufffdL\ufffdR\ufffd\ufffdy\ufffd \ufffd\ufffd\ufffd\ufffd~\ufffd;u\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffdS\u058fX\ufffdY\ufffd\u0252\ufffd!\ufffdw$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdZ \u0017'\ufffdX\/\ufffdU\ufffdo\ufffdON\"e!\ufffd=\ufffdS\ufffdL\ufffdR\ufffd\ufffdy\u000e\ufffd \ufffd\ufffd\ufffd\b\ufffd~\ufffd;u\u001f\ufffd\ufffd\ufffd\u001a\ufffd{\ufffd\ufffdS\u058fX\ufffdY\ufffd\u0252\ufffd\f!\ufffdw\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdZ '\ufffdX\/\ufffdU\ufffdo\ufffdON\"e!\ufffd=\ufffdS\ufffdL\ufffdR\ufffd\ufffdy\ufffd \ufffd\ufffd\ufffd\ufffd~\ufffd;u\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffdS\u058fX\ufffdY\ufffd\u0252\ufffd!\ufffdw$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.9256580671611774,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b78f1c0f0f38f68a6ffca1b872531b1a",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd<\ufffd\"V2\ufffd\ufffdq\ufffd\u077d\u02a5\ufffd\ufffdiC\ufffd\u000f\ufffd\ufffd\ufffd\ufffdZ\ufffdZK\ufffd\ufffd` \ufffd\n\u0015>\ufffd\ufffd![J\ufffdl\ufffd\ufffd:D\ufffd\ufffd\ufffdW\ufffdm\ufffd\u0795\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\u0018\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd<\ufffd\"V2\ufffd\ufffdq\ufffd\u077d\u02a5\ufffd\ufffdiC\ufffd\u000f\ufffd\ufffd\ufffd\ufffdZ\ufffdZK\ufffd\ufffd` \ufffd\n\u0015>\ufffd\ufffd![J\ufffdl\ufffd\ufffd:D\ufffd\ufffd\ufffdW\ufffdm\ufffd\u0795\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\u0018\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 |8\ufffdX\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd<\ufffd\"V2\ufffd\ufffdq\ufffd\u077d\u02a5\ufffd\ufffdiC\ufffd\u000f\ufffd\ufffd\ufffd\ufffdZ\ufffdZK\ufffd\ufffd` \ufffd\n\u0015>\ufffd\ufffd![J\ufffdl\ufffd\ufffd:D\ufffd\ufffd\ufffdW\ufffdm\ufffd\u0795\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\u0018\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cb42b36e3d72f0734016418304c3bfa9e34caff6",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd<\ufffd\"V2\ufffd\ufffdq\ufffd\u077d\u02a5\ufffd\ufffdiC\ufffd\u000f\ufffd\ufffd\ufffd\ufffdZ\ufffdZK\ufffd\ufffd` \ufffd\n\u0015>\ufffd\ufffd![J\ufffdl\ufffd\ufffd:D\ufffd\ufffd\ufffdW\ufffdm\ufffd\u0795\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\u0018\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd<\ufffd\"V2\ufffd\ufffdq\ufffd\u077d\u02a5\ufffd\ufffdiC\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffdZK\ufffd\ufffd` \ufffd\n>\ufffd\ufffd![J\ufffdl\ufffd\ufffd:D\ufffd\ufffd\ufffdW\ufffdm\ufffd\u0795\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd<\ufffd\"V2\ufffd\ufffdq\ufffd\u077d\u02a5\ufffd\ufffdiC\ufffd\u000f\ufffd\ufffd\ufffd\ufffdZ\ufffdZK\ufffd\ufffd` \ufffd\n\u0015>\ufffd\ufffd![J\ufffdl\ufffd\ufffd:D\ufffd\ufffd\ufffdW\ufffdm\ufffd\u0795\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd\u0018\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd<\ufffd\"V2\ufffd\ufffdq\ufffd\u077d\u02a5\ufffd\ufffdiC\ufffd\ufffd\ufffd\ufffd\ufffdZ\ufffdZK\ufffd\ufffd` \ufffd\n>\ufffd\ufffd![J\ufffdl\ufffd\ufffd:D\ufffd\ufffd\ufffdW\ufffdm\ufffd\u0795\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.859108024691997,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "88c383f5fde8f460ae2363f0a09e9acd",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd+\ufffd\ufffd\u0007K8\ufffd\ufffd\ufffdh\ufffd\f\ufffd%.\ufffd\ufffd\ufffd=\ufffd<9\u0018S*\ufffd\ufffd\n\ufffdI \ufffd\u0015\ufffdPs\ufffd\ufffd\u0781ZT\ufffdD\u0013Z\ufffd\ufffda3\u0016\ufffdC\ufffd\ufffd\u0011.\ufffd\n\ufffd\"\u0007\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd+\ufffd\ufffd\u0007K8\ufffd\ufffd\ufffdh\ufffd\f\ufffd%.\ufffd\ufffd\ufffd=\ufffd<9\u0018S*\ufffd\ufffd\n\ufffdI \ufffd\u0015\ufffdPs\ufffd\ufffd\u0781ZT\ufffdD\u0013Z\ufffd\ufffda3\u0016\ufffdC\ufffd\ufffd\u0011.\ufffd\n\ufffd\"\u0007\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 %\u0005\u0015\u0016\u0005\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd+\ufffd\ufffd\u0007K8\ufffd\ufffd\ufffdh\ufffd\f\ufffd%.\ufffd\ufffd\ufffd=\ufffd<9\u0018S*\ufffd\ufffd\n\ufffdI \ufffd\u0015\ufffdPs\ufffd\ufffd\u0781ZT\ufffdD\u0013Z\ufffd\ufffda3\u0016\ufffdC\ufffd\ufffd\u0011.\ufffd\n\ufffd\"\u0007\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b24498e2886b20fb09b895cc3823b7795a00cd9b",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd+\ufffd\ufffd\u0007K8\ufffd\ufffd\ufffdh\ufffd\f\ufffd%.\ufffd\ufffd\ufffd=\ufffd<9\u0018S*\ufffd\ufffd\n\ufffdI \ufffd\u0015\ufffdPs\ufffd\ufffd\u0781ZT\ufffdD\u0013Z\ufffd\ufffda3\u0016\ufffdC\ufffd\ufffd\u0011.\ufffd\n\ufffd\"\u0007\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd+\ufffd\ufffdK8\ufffd\ufffd\ufffdh\ufffd\ufffd%.\ufffd\ufffd\ufffd=\ufffd<9S*\ufffd\ufffd\n\ufffdI \ufffd\ufffdPs\ufffd\ufffd\u0781ZT\ufffdDZ\ufffd\ufffda3\ufffdC\ufffd\ufffd.\ufffd\n\ufffd\"\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd+\ufffd\ufffd\u0007K8\ufffd\ufffd\ufffdh\ufffd\f\ufffd%.\ufffd\ufffd\ufffd=\ufffd<9\u0018S*\ufffd\ufffd\n\ufffdI \ufffd\u0015\ufffdPs\ufffd\ufffd\u0781ZT\ufffdD\u0013Z\ufffd\ufffda3\u0016\ufffdC\ufffd\ufffd\u0011.\ufffd\n\ufffd\"\u0007\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd+\ufffd\ufffdK8\ufffd\ufffd\ufffdh\ufffd\ufffd%.\ufffd\ufffd\ufffd=\ufffd<9S*\ufffd\ufffd\n\ufffdI \ufffd\ufffdPs\ufffd\ufffd\u0781ZT\ufffdDZ\ufffd\ufffda3\ufffdC\ufffd\ufffd.\ufffd\n\ufffd\"\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.883725376851148,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "9740d421a0c1d613636276e2d9b4a751",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0003\u0630Z\ufffd\ufffd\ufffd?T\ufffd\ufffd\ufffd\u001cv\ufffd\ufffd\"\r\\1\ufffdo8\ufffd.\\\u0001\ufffd\ufffd\n\ufffd+ \ufffd'!>\ufffd\u05de\ufffd<\ufffd\u0011D\ufffd,\ufffd\u001c\ufffd\ufffdC\ufffd\ufffd2XO\ufffd\ufffd\ufffd2\ufffdr\u0002\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0003\u0630Z\ufffd\ufffd\ufffd?T\ufffd\ufffd\ufffd\u001cv\ufffd\ufffd\"\r\\1\ufffdo8\ufffd.\\\u0001\ufffd\ufffd\n\ufffd+ \ufffd'!>\ufffd\u05de\ufffd<\ufffd\u0011D\ufffd,\ufffd\u001c\ufffd\ufffdC\ufffd\ufffd2XO\ufffd\ufffd\ufffd2\ufffdr\u0002\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 V\ufffd\ufffd\ufffd2`",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0003\u0630Z\ufffd\ufffd\ufffd?T\ufffd\ufffd\ufffd\u001cv\ufffd\ufffd\"\r\\1\ufffdo8\ufffd.\\\u0001\ufffd\ufffd\n\ufffd+ \ufffd'!>\ufffd\u05de\ufffd<\ufffd\u0011D\ufffd,\ufffd\u001c\ufffd\ufffdC\ufffd\ufffd2XO\ufffd\ufffd\ufffd2\ufffdr\u0002\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a46a3c85528ae739bbb6323079109a6ceb0d7728",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0003\u0630Z\ufffd\ufffd\ufffd?T\ufffd\ufffd\ufffd\u001cv\ufffd\ufffd\"\r\\1\ufffdo8\ufffd.\\\u0001\ufffd\ufffd\n\ufffd+ \ufffd'!>\ufffd\u05de\ufffd<\ufffd\u0011D\ufffd,\ufffd\u001c\ufffd\ufffdC\ufffd\ufffd2XO\ufffd\ufffd\ufffd2\ufffdr\u0002\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\u0630Z\ufffd\ufffd\ufffd?T\ufffd\ufffd\ufffdv\ufffd\ufffd\"\r\\1\ufffdo8\ufffd.\\\ufffd\ufffd\n\ufffd+ \ufffd'!>\ufffd\u05de\ufffd<\ufffdD\ufffd,\ufffd\ufffd\ufffdC\ufffd\ufffd2XO\ufffd\ufffd\ufffd2\ufffdr\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0003\u0630Z\ufffd\ufffd\ufffd?T\ufffd\ufffd\ufffd\u001cv\ufffd\ufffd\"\r\\1\ufffdo8\ufffd.\\\u0001\ufffd\ufffd\n\ufffd+ \ufffd'!>\ufffd\u05de\ufffd<\ufffd\u0011D\ufffd,\ufffd\u001c\ufffd\ufffdC\ufffd\ufffd2XO\ufffd\ufffd\ufffd2\ufffdr\u0002\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\u0630Z\ufffd\ufffd\ufffd?T\ufffd\ufffd\ufffdv\ufffd\ufffd\"\r\\1\ufffdo8\ufffd.\\\ufffd\ufffd\n\ufffd+ \ufffd'!>\ufffd\u05de\ufffd<\ufffdD\ufffd,\ufffd\ufffd\ufffdC\ufffd\ufffd2XO\ufffd\ufffd\ufffd2\ufffdr\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.918096680536873,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a9c91535ca25321e0596e939a2d154b6",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0002\ufffd\ufffd9\ufffdS\ufffd\ufffd\ufffd\ufffdW_\ufffd\ufffd'Q\ufffdp\u000f\ufffdWm\u077f\ufffd\ufffdn\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\u0012I\ufffdEH\ufffd\ufffdp\ufffd=]um:[\ufffd\n8\ufffd\ufffdX\f\ufffdfZ\ufffd3\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0002\ufffd\ufffd9\ufffdS\ufffd\ufffd\ufffd\ufffdW_\ufffd\ufffd'Q\ufffdp\u000f\ufffdWm\u077f\ufffd\ufffdn\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\u0012I\ufffdEH\ufffd\ufffdp\ufffd=]um:[\ufffd\n8\ufffd\ufffdX\f\ufffdfZ\ufffd3\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0016P5\ufffdZ\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0002\ufffd\ufffd9\ufffdS\ufffd\ufffd\ufffd\ufffdW_\ufffd\ufffd'Q\ufffdp\u000f\ufffdWm\u077f\ufffd\ufffdn\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\u0012I\ufffdEH\ufffd\ufffdp\ufffd=]um:[\ufffd\n8\ufffd\ufffdX\f\ufffdfZ\ufffd3\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "be7a7193c96c8d39966a398723a17b52bc1604cb",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0002\ufffd\ufffd9\ufffdS\ufffd\ufffd\ufffd\ufffdW_\ufffd\ufffd'Q\ufffdp\u000f\ufffdWm\u077f\ufffd\ufffdn\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\u0012I\ufffdEH\ufffd\ufffdp\ufffd=]um:[\ufffd\n8\ufffd\ufffdX\f\ufffdfZ\ufffd3\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd9\ufffdS\ufffd\ufffd\ufffd\ufffdW_\ufffd\ufffd'Q\ufffdp\ufffdWm\u077f\ufffd\ufffdn\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffdI\ufffdEH\ufffd\ufffdp\ufffd=]um:[\ufffd\n8\ufffd\ufffdX\ufffdfZ\ufffd3\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u0002\ufffd\ufffd9\ufffdS\ufffd\ufffd\ufffd\ufffdW_\ufffd\ufffd'Q\ufffdp\u000f\ufffdWm\u077f\ufffd\ufffdn\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffd\u0012I\ufffdEH\ufffd\ufffdp\ufffd=]um:[\ufffd\n8\ufffd\ufffdX\f\ufffdfZ\ufffd3\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd9\ufffdS\ufffd\ufffd\ufffd\ufffdW_\ufffd\ufffd'Q\ufffdp\ufffdWm\u077f\ufffd\ufffdn\ufffd\ufffd.\ufffd\ufffd \ufffd\ufffdI\ufffdEH\ufffd\ufffdp\ufffd=]um:[\ufffd\n8\ufffd\ufffdX\ufffdfZ\ufffd3\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.8622267566786417,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "cdd97ff540f7ee8010910432e7a04103",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdW\ufffd\u000e\u001d\u057c \ufffd\ufffd\ufffd\ufffd;\ufffd\ufffdp\ufffd\ufffd\ufffdHb\u031e\u0014\ufffde\ufffd\u0007\u0014ea c\ufffd)\ufffd\ufffd\ufffd\u0013\ufffd\ufffdkWn%\ufffdkbl\u0006=\ufffd\ufffdZ\ufffdj\ufffd\ufffd\u0004Ze\u001e\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdW\ufffd\u000e\u001d\u057c \ufffd\ufffd\ufffd\ufffd;\ufffd\ufffdp\ufffd\ufffd\ufffdHb\u031e\u0014\ufffde\ufffd\u0007\u0014ea c\ufffd)\ufffd\ufffd\ufffd\u0013\ufffd\ufffdkWn%\ufffdkbl\u0006=\ufffd\ufffdZ\ufffdj\ufffd\ufffd\u0004Ze\u001e\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \n\ufffd\ufffda\ufffd\u0016",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdW\ufffd\u000e\u001d\u057c \ufffd\ufffd\ufffd\ufffd;\ufffd\ufffdp\ufffd\ufffd\ufffdHb\u031e\u0014\ufffde\ufffd\u0007\u0014ea c\ufffd)\ufffd\ufffd\ufffd\u0013\ufffd\ufffdkWn%\ufffdkbl\u0006=\ufffd\ufffdZ\ufffdj\ufffd\ufffd\u0004Ze\u001e\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "01ba375ca6c270e2798c9062c3ed080cd9ea1a1f",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdW\ufffd\u000e\u001d\u057c \ufffd\ufffd\ufffd\ufffd;\ufffd\ufffdp\ufffd\ufffd\ufffdHb\u031e\u0014\ufffde\ufffd\u0007\u0014ea c\ufffd)\ufffd\ufffd\ufffd\u0013\ufffd\ufffdkWn%\ufffdkbl\u0006=\ufffd\ufffdZ\ufffdj\ufffd\ufffd\u0004Ze\u001e\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdW\ufffd\u057c \ufffd\ufffd\ufffd\ufffd;\ufffd\ufffdp\ufffd\ufffd\ufffdHb\u031e\ufffde\ufffdea c\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffdkWn%\ufffdkbl=\ufffd\ufffdZ\ufffdj\ufffd\ufffdZe\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdW\ufffd\u000e\u001d\u057c \ufffd\ufffd\ufffd\ufffd;\ufffd\ufffdp\ufffd\ufffd\ufffdHb\u031e\u0014\ufffde\ufffd\u0007\u0014ea c\ufffd)\ufffd\ufffd\ufffd\u0013\ufffd\ufffdkWn%\ufffdkbl\u0006=\ufffd\ufffdZ\ufffdj\ufffd\ufffd\u0004Ze\u001e\ufffd\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdW\ufffd\u057c \ufffd\ufffd\ufffd\ufffd;\ufffd\ufffdp\ufffd\ufffd\ufffdHb\u031e\ufffde\ufffdea c\ufffd)\ufffd\ufffd\ufffd\ufffd\ufffdkWn%\ufffdkbl=\ufffd\ufffdZ\ufffdj\ufffd\ufffdZe\ufffd\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043",
    "emulator_response_len": 177,
    "bytes_in": 517,
    "payload_entropy": 3.9102720182080417,
    "port_category": "registered",
    "org": "UNICOM AnHui province network",
    "service": "weblogic",
    "app_proto": "weblogic",
    "asn": 140726,
    "country": "CN",
    "dst_port": 7001,
    "risk_waf": 8,
    "risk_classification": 58,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a513a8b6579875aee9e6cefbe17ae13f4cd756cc",
    "event_fingerprint": "4ea7ffe7bc9ade2843b5e81016a496bfea35cfd6",
    "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "precision_score": 87,
    "precision_signals": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-weblogic_console",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 58,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "weblogic",
    "risk_confidence_factor": 77,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 140726,
        "org": "UNICOM AnHui province network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "34d5a9de369fc70a2ade7d0228c9c059",
        "path_pattern_hash": "a179ef516d6662010534ca5ee85ea8d3"
    },
    "target_context": {
        "dst_port": 7001,
        "service": "weblogic",
        "service_name": "weblogic",
        "risk_score": 33
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdY=hf\ufffde\ufffd\u0633\ufffd\ufffd\ufffdx[\u0007\ufffd\ufffdt\ufffd'\ufffd\u0010_Y\ufffd~MY\ufffdK\ufffd \ufffd\ufffd\ufffd\u001e\ufffd\ufffdo\ufffdJxX\ufffd\ufffd\ufffd3\ufffdP\u03e8\ufffdu\u0000\ufffdi\ufffd\ufffd\ufffds\ufffdZ\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdY=hf\ufffde\ufffd\u0633\ufffd\ufffd\ufffdx[\u0007\ufffd\ufffdt\ufffd'\ufffd\u0010_Y\ufffd~MY\ufffdK\ufffd \ufffd\ufffd\ufffd\u001e\ufffd\ufffdo\ufffdJxX\ufffd\ufffd\ufffd3\ufffdP\u03e8\ufffdu\u0000\ufffdi\ufffd\ufffd\ufffds\ufffdZ\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u00001\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 N\ufffd\ufffd\u0019",
        "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdY=hf\ufffde\ufffd\u0633\ufffd\ufffd\ufffdx[\u0007\ufffd\ufffdt\ufffd'\ufffd\u0010_Y\ufffd~MY\ufffdK\ufffd \ufffd\ufffd\ufffd\u001e\ufffd\ufffdo\ufffdJxX\ufffd\ufffd\ufffd3\ufffdP\u03e8\ufffdu\u0000\ufffdi\ufffd\ufffd\ufffds\ufffdZ\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "enterprise_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "648576cf3b44b964e3a14c22aeed9ff8aba15fe4",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdY=hf\ufffde\ufffd\u0633\ufffd\ufffd\ufffdx[\u0007\ufffd\ufffdt\ufffd'\ufffd\u0010_Y\ufffd~MY\ufffdK\ufffd \ufffd\ufffd\ufffd\u001e\ufffd\ufffdo\ufffdJxX\ufffd\ufffd\ufffd3\ufffdP\u03e8\ufffdu\u0000\ufffdi\ufffd\ufffd\ufffds\ufffdZ\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
        "port": 7001,
        "service": "weblogic",
        "service_label_fr": "WEBLOGIC"
    },
    "evidence_snippet": "\ufffd\ufffdY=hf\ufffde\ufffd\u0633\ufffd\ufffd\ufffdx[\ufffd\ufffdt\ufffd'\ufffd_Y\ufffd~MY\ufffdK\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdo\ufffdJxX\ufffd\ufffd\ufffd3\ufffdP\u03e8\ufffdu\ufffdi\ufffd\ufffd\ufffds\ufffdZ\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
    "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
    "target_port_label": "7001 \u00b7 WEBLOGIC",
    "emulator_service": "weblogic",
    "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab weblogic_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 58,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": "weblogic",
        "service_label_fr": "WEBLOGIC",
        "dst_port": 7001,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-weblogic_console",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Weblogic Console",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-weblogic",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdY=hf\ufffde\ufffd\u0633\ufffd\ufffd\ufffdx[\u0007\ufffd\ufffdt\ufffd'\ufffd\u0010_Y\ufffd~MY\ufffdK\ufffd \ufffd\ufffd\ufffd\u001e\ufffd\ufffdo\ufffdJxX\ufffd\ufffd\ufffd3\ufffdP\u03e8\ufffdu\u0000\ufffdi\ufffd\ufffd\ufffds\ufffdZ\ufffd\u0000$\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\u0000\ufffd\u0000\ufffd\u0000k\u0000g\u0000\ufffd\u0001\u0000\u0001\ufffd\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000",
            "port": 7001,
            "service": "weblogic",
            "service_label_fr": "WEBLOGIC"
        },
        "attack_vector": "weblogic probe \u00b7 via WEBLOGIC:7001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdY=hf\ufffde\ufffd\u0633\ufffd\ufffd\ufffdx[\ufffd\ufffdt\ufffd'\ufffd_Y\ufffd~MY\ufffdK\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdo\ufffdJxX\ufffd\ufffd\ufffd3\ufffdP\u03e8\ufffdu\ufffdi\ufffd\ufffd\ufffds\ufffdZ\ufffd$\ufffd,\ufffd0\ufffd+\ufffd\/\u0329\u0328\ufffd$\ufffd(\ufffd#\ufffd'\ufffd\ufffdkg\ufffd\ufffd",
        "target_port_label": "7001 \u00b7 WEBLOGIC",
        "emulator_service": "weblogic",
        "confidence_reason": "Confiance 77 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "weblogic",
        "service_banner": "honeypot-weblogic",
        "service_os": "linux",
        "dst_port": "7001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "weblogic"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_weblogic_probe",
        "tls_clienthello",
        "weblogic_emulated"
    ]
}