4.217.182.147

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f",
    "emulator_response_len": 106,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Microsoft Corporation",
    "service": "node-http",
    "app_proto": "node-http",
    "asn": 8075,
    "country": "KR",
    "dst_port": 3000,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "7c356cd3f41196ebc417361b0f54b35bbef962c4",
    "event_fingerprint": "34fd482cd7628741af06d058b16059cafd546c90",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 8075,
        "org": "Microsoft Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
    },
    "service_name": "node-http",
    "target_context": {
        "dst_port": 3000,
        "service": "node-http",
        "service_name": "node-http",
        "risk_score": 40
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.71,
    "classification_confidence": 0.71,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9fbb176b8be7c53f9f74a0d17880aaafba7d2e40",
    "protocol_details": {
        "port": 3000,
        "service": "node-http",
        "service_label_fr": "NODE HTTP"
    },
    "attack_vector": "Sonde HTTP \u00b7 via NODE HTTP:3000 \u00b7 (sonde \/ probe)",
    "target_port_label": "3000 \u00b7 NODE HTTP",
    "emulator_service": "node-http",
    "confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 71,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "node-http",
        "service_label_fr": "NODE HTTP",
        "dst_port": 3000,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-node-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 3000,
            "service": "node-http",
            "service_label_fr": "NODE HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via NODE HTTP:3000 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "3000 \u00b7 NODE HTTP",
        "emulator_service": "node-http",
        "confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "node_http",
        "service_banner": "honeypot-node-http",
        "service_os": "linux",
        "dst_port": "3000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_web_probe",
        "node_http_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d",
    "emulator_response_len": 107,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Microsoft Corporation",
    "service": "grafana",
    "app_proto": "grafana",
    "asn": 8075,
    "country": "KR",
    "dst_port": 3001,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "fa5e9f89adb2c47cafc508db34cacd873d1de716",
    "event_fingerprint": "0f885f7557e23a2165fec6e25217796b52e0b682",
    "classification_reason": "Type \u00ab grafana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 24,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "grafana",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 8075,
        "org": "Microsoft Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6fe594699bf22753f400c105c5e66cd2"
    },
    "target_context": {
        "dst_port": 3001,
        "service": "grafana",
        "service_name": "grafana",
        "risk_score": 24
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a45c6598dfbd7f36d43b9df396afaa630d6ff129",
    "protocol_details": {
        "port": 3001,
        "service": "grafana",
        "service_label_fr": "GRAFANA"
    },
    "attack_vector": "grafana probe \u00b7 via GRAFANA:3001 \u00b7 (sonde \/ probe)",
    "target_port_label": "3001 \u00b7 GRAFANA",
    "emulator_service": "grafana",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab grafana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab grafana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 24,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "grafana",
        "service_label_fr": "GRAFANA",
        "dst_port": 3001,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-grafana",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 3001,
            "service": "grafana",
            "service_label_fr": "GRAFANA"
        },
        "attack_vector": "grafana probe \u00b7 via GRAFANA:3001 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "3001 \u00b7 GRAFANA",
        "emulator_service": "grafana",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "grafana",
        "service_banner": "honeypot-grafana",
        "service_os": "linux",
        "dst_port": "3001"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "grafana",
        "node-http"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "grafana_emulated",
        "net_grafana_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 81,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Microsoft Corporation",
    "service": "http",
    "app_proto": "http",
    "asn": 8075,
    "country": "KR",
    "dst_port": 8080,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "986800c5ad65e75d541a277e48953dacf3f318da",
    "event_fingerprint": "5afc6680f618e490dc22cb875ac6d45b5c7d65ea",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 12
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 8075,
        "org": "Microsoft Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 8080,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ec0d9c04c0ca4c6f3f5751f61cb3292056e53511",
    "protocol_details": {
        "port": 8080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)",
    "target_port_label": "8080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 12
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8080,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +12",
        "protocol_details": {
            "port": 8080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "8080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 30,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "grafana",
        "http",
        "node-http"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 12,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_8080",
        "http_alt_port",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Microsoft Corporation",
    "service": "https",
    "app_proto": "https",
    "asn": 8075,
    "country": "KR",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "baa690d1c17ffc3e0bea7942e5e4e6fb74221eb7",
    "event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "KR",
        "asn": 8075,
        "org": "Microsoft Corporation",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "https",
        "service_name": "https",
        "risk_score": 42
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e60a26334f537d7ee892a05a34818b25b703890f",
    "protocol_details": {
        "port": 8443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
    "target_port_label": "8443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTPS \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 8443,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "port": 8443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "port scan syn \u00b7 via HTTPS:8443 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "8443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "8443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        3000,
        3001,
        8080,
        8443
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 40,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "grafana",
        "http",
        "https",
        "node-http"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe"
    ]
}