Renseignement sur les menaces

Espagne

45.134.213.204

FAI Datacamp Limited Première vue 20/07/2026 17:01 UTC Dernière vue 21/07/2026 00:18 UTC Risque Moyen

Période analysée : 2026-06-21 → 2026-07-21

Activité suspecte — risque 48/100 (Moyen) — MITRE T1046 — confiance 100 % — via CONSUL — multi-protocole (4 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 50/100 Moyen

Première observation 20/07/2026 17:01 UTC

Dernière observation 21/07/2026 00:18 UTC

Événements (période) 101

MITRE ATT&CK principal TA0007 70 occurrences

Activité suspecte — risque 48/100 (Moyen) — MITRE T1046 — confiance 100 % — via CONSUL — multi-protocole (4 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « port_scan_syn » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +18

Comparaison ASN / FAI

ASN 212238 · 45.134.213.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 101 événements sur la période pour cette IP.

187.13.30.16 Sonde port 6379/TCP 21/07/2026 15:13 UTC
89.187.168.40 Sonde Memcached 21/07/2026 14:57 UTC
37.19.200.4 Sonde HTTP smuggling 21/07/2026 00:21 UTC
82.21.56.9 Sonde port 6379/TCP 20/07/2026 18:25 UTC
79.127.221.66 Sonde PostgreSQL 20/07/2026 11:48 UTC
149.102.246.12 consul probe 20/07/2026 09:09 UTC
147.90.209.18 Tentative d'exploit 20/07/2026 02:21 UTC
82.21.56.72 consul probe 19/07/2026 16:15 UTC

Événements (filtres)

101

Première observation

20/07/2026 17:01 UTC

Dernière observation

21/07/2026 00:18 UTC

Dernière activité (filtres)

21/07/2026 00:18 UTC

Événements 7j

101

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

CONSUL TCP 72 ETCD TCP 9 HTTP TCP 7 REDIS TCP 7 DOCKER TCP 2 SSH ALT2 TCP 1 CICS ALT TCP 1 SSH TCP 1

CONSUL

ETCD

HTTP

REDIS

DOCKER

SSH ALT2

Géolocalisation

Origine réseau déclarée

Espagne unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Datacamp Limited 0 Port 8500 consul_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via CONSUL:8500 · (reconnaissance)

Détails protocole

Aperçu payload

GET /v1/kv/?recurse=true&keys=true HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.

Port / service

8500 · CONSUL

Service émulé

CONSUL

Raison confiance

Confiance 100 % — 6 signal(aux) capteur

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S

Confiance

100% Corrélation +18

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

101 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

101 événement(s) — page 2/3

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
20/07/2026 17:52:24 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /webmail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Pourquoi cette classification :* Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /webmail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Requête brute (extrait) GET /webmail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: /* Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 157, "payload_entropy": 5.194354961198715, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "76b7ce8e66710bb158e389c3acc50822", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "request_sample": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "evidence": { "request_sample": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1b48844a8a4763a81e17b8f5ff2575505f70e4fc", "protocol_details": { "payload_preview": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: *\/", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:24 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /mail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /mail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Requête brute (extrait) GET /mail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 154, "payload_entropy": 5.171620551470184, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c08cba4a13711954c56df1e9a666c07d", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\n", "request_sample": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "evidence": { "request_sample": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ea1bb7612a2e826a508e4461e9b9d699634d200d", "protocol_details": { "payload_preview": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:23 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /package.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accep Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /package.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accep Requête brute (extrait) GET /package.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 162, "payload_entropy": 5.155224881484458, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0b39259c132501ac692769e84278fb35", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "request_sample": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "evidence": { "request_sample": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6c5e6b1ad2d5fb179b8fded4f1721650d1afdfda", "protocol_details": { "payload_preview": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:23 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: * Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: * Requête brute (extrait) GET /api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b226f70656e617069223a22332e30", "emulator_response_len": 222, "bytes_in": 158, "payload_entropy": 5.140383141852187, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e00c4fe7d8327b6ad4a1f509bbac4344", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "request_sample": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "evidence": { "request_sample": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6c17be69115b48906a6f8bcc558337e7585334ca", "protocol_details": { "payload_preview": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: *", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ], "behavior_alert_count": 2, "behavior_priority": 72 }
20/07/2026 17:52:23 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /v2/api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /v2/api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /v2/api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b226f70656e617069223a22332e30", "emulator_response_len": 222, "bytes_in": 161, "payload_entropy": 5.152832562762997, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "96cc8dc5b2969e8c31e8fb151fc79015", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "663b78f796d167bfa0133eed1b288742dca34da3", "protocol_details": { "payload_preview": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ], "behavior_alert_count": 1, "behavior_priority": 84 }
20/07/2026 17:52:22 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /.git/config HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.git/config HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /.git/config HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 161, "payload_entropy": 5.128608124689145, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 6, "anomaly_count": 0, "campaign_key": "2c2f44214c505f03c7f44871397dc98135e03457", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cdc0896b4e71c7355df735e073022536", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f092eb5304c9003eb00f98119186bec82179a397", "protocol_details": { "payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe", "redis_config_probe" ] }
20/07/2026 17:52:22 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /.git/HEAD HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.git/HEAD HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Requête brute (extrait) GET /.git/HEAD HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 159, "payload_entropy": 5.16554671456879, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ee0a320bfbd980b3e8351e86ae6ca0a5", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "request_sample": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "evidence": { "request_sample": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "95da0fb97b4abd132c8d65d29d2d0f9fe3da2471", "protocol_details": { "payload_preview": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:22 UTC	TCP	8500 · CONSUL	consul	tor exit probe tor exit probe · via CONSUL:8500 · (commande & contrôle)	Élevée	Faible · 35
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /actuator/env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accep Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 46% Confiance classification 46% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 46 % — 6 signal(aux) capteur Protocole émulé 1 Signaux Tor Exit Hint Technique MITRE TA0011 Tactiques MITRE TA0011 User-Agent — Règles WAF — Payload (extrait) GET /actuator/env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accep Requête brute (extrait) GET /actuator/env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 162, "payload_entropy": 5.135611073034414, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 35, "tag_count": 6, "anomaly_count": 0, "campaign_key": "05ffe8bb367d85014736f1366731b882d5af8e23", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "confidence": 0.46, "classification_confidence": 0.46, "precision_score": 55, "precision_signals": [ "INT-TOR-exit-hint" ], "kb_rule_ids": [ "INT-TOR-exit-hint" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 46, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "35c2e0d2d297d90e844fd46d939008cc", "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 35 }, "payload_preview": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "request_sample": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "evidence": { "request_sample": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "34180d82f831029c5dbc676d133e68601cdd0993", "protocol_details": { "payload_preview": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "attack_vector": "tor exit probe \u00b7 via CONSUL:8500 \u00b7 (commande & contr\u00f4le)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 46 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 46 % \u2014 via CONSUL", "confidence_pct": 46, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 35 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 35, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": [ "INT-TOR-exit-hint" ], "tags_summary_labels_fr": [ "Tor Exit Hint" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "tor exit probe \u00b7 via CONSUL:8500 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 46 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 46 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe", "tor_exit_probe" ] }
20/07/2026 17:52:22 UTC	TCP	8500 · CONSUL	consul	tor exit probe tor exit probe · via CONSUL:8500 · (commande & contrôle)	Élevée	Faible · 35
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /actuator/health HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Ac Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 46% Confiance classification 46% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 46 % — 6 signal(aux) capteur Protocole émulé 1 Signaux Tor Exit Hint Technique MITRE TA0011 Tactiques MITRE TA0011 User-Agent — Règles WAF — Payload (extrait) GET /actuator/health HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Ac Requête brute (extrait) GET /actuator/health HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f766e642e737072696e672d626f6f742e6163747561746f722e76332b6a736f6e0d0a436f6e74656e742d4c656e6774683a2034390d0a436f6e6e656374696f", "emulator_response_len": 189, "bytes_in": 165, "payload_entropy": 5.143946011669833, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 35, "tag_count": 6, "anomaly_count": 0, "campaign_key": "05ffe8bb367d85014736f1366731b882d5af8e23", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "confidence": 0.46, "classification_confidence": 0.46, "precision_score": 55, "precision_signals": [ "INT-TOR-exit-hint" ], "kb_rule_ids": [ "INT-TOR-exit-hint" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 46, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "796edf116feeb3389975a5be852bfb83", "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 35 }, "payload_preview": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "request_sample": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "evidence": { "request_sample": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e16212a03f67188947b3069e707523a54e5da660", "protocol_details": { "payload_preview": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "attack_vector": "tor exit probe \u00b7 via CONSUL:8500 \u00b7 (commande & contr\u00f4le)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 46 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 46 % \u2014 via CONSUL", "confidence_pct": 46, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 35 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 35, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": [ "INT-TOR-exit-hint" ], "tags_summary_labels_fr": [ "Tor Exit Hint" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "tor exit probe \u00b7 via CONSUL:8500 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 46 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 46 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe", "tor_exit_probe" ] }
20/07/2026 17:52:21 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /settings.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Acce Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /settings.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Acce Requête brute (extrait) GET /settings.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 163, "payload_entropy": 5.120093086113792, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "058708fe0c61a69f88d484af855c3dd9", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "request_sample": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "evidence": { "request_sample": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2d57978b3351fb8f97926c76e44961b81efd481d", "protocol_details": { "payload_preview": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:21 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /.env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Requête brute (extrait) GET /.env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 154, "payload_entropy": 5.129692136898174, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "601e6c6cffcc3c29a8f6cbc1629296a6", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\n", "request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "evidence": { "request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f1107736c750d567504429b3a77639a36c00582a", "protocol_details": { "payload_preview": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:20 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: * Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: * Requête brute (extrait) GET /api/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 158, "payload_entropy": 5.142013441543261, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4729507fe7919e06055a5eefa9bd1e85", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "request_sample": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "evidence": { "request_sample": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9de379f4cb2b2f14045569db0a30e3645997bd21", "protocol_details": { "payload_preview": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: *", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:20 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /info.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /info.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Requête brute (extrait) GET /info.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 159, "payload_entropy": 5.150513006860846, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "54d1ae0a1ef1018f99a8a9588ddf71b1", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "request_sample": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "evidence": { "request_sample": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "34c36955f0ac9327f01506a7da317e049003e406", "protocol_details": { "payload_preview": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:20 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /config.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /config.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /config.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 161, "payload_entropy": 5.149527786516789, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 6, "anomaly_count": 0, "campaign_key": "2c2f44214c505f03c7f44871397dc98135e03457", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "79e98d1a07114eca2acf047962bf5fcd", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0faba8cdcbec45e1ecf13905acf2f381a188a4e5", "protocol_details": { "payload_preview": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe", "redis_config_probe" ] }
20/07/2026 17:52:19 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api/devices HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/devices HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /api/devices HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b2264657669636573223a5b5d2c2274", "emulator_response_len": 137, "bytes_in": 161, "payload_entropy": 5.131536501099151, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "497d6244d73aa765b6268da14260b9d0", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "171858fc045bc5c53bc801ed09c5244f48c380b9", "protocol_details": { "payload_preview": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:19 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api/firmware/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/firmware/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Requête brute (extrait) GET /api/firmware/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 167, "payload_entropy": 5.182854006680233, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8bd6f3397d745a1751be84d821a7c034", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\n", "request_sample": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "evidence": { "request_sample": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4bc7475eeca34de9ac4df131fb3a0fdd222cb0cb", "protocol_details": { "payload_preview": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:19 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api/status HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/status HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Requête brute (extrait) GET /api/status HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 160, "payload_entropy": 5.138274230551065, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "84b6d0cd467e9ef0985f75ed05130f21", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "request_sample": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "evidence": { "request_sample": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d4d64f649ab8a4c03a5c8d78f8674dd01299a12a", "protocol_details": { "payload_preview": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:18 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /status.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /status.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /status.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 161, "payload_entropy": 5.147363093686996, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1bbe80c6d75358017aa114acba93203a", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ca79278aa6cc547aafb4232059f5c62e8851e98b", "protocol_details": { "payload_preview": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:18 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /metrics HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Pourquoi cette classification :* Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Requête brute (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: /* Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020", "emulator_response_len": 154, "bytes_in": 157, "payload_entropy": 5.143297557179585, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5f6bde2e1cb1a61526eebefc1504490a", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "evidence": { "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d14120f192c089fa03c0c4c9caee6d78e18d3722", "protocol_details": { "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: *\/", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:18 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /healthz HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Pourquoi cette classification :* Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /healthz HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Requête brute (extrait) GET /healthz HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: /* Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 157, "payload_entropy": 5.158211190238794, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "356e6142867942187399aa1de7ae4ad9", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "request_sample": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "evidence": { "request_sample": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc051ca510aa67393b8925a46b7b0a6d447e0279", "protocol_details": { "payload_preview": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: *\/", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:52:17 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET / HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Conn Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Conn Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 150, "payload_entropy": 5.138577711416924, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0922be1539baa8a8413ed8d566ae37a6", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "738917205be8d63d29d685bf22329c0431d13cb4", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ], "behavior_alert_count": 1, "behavior_priority": 72 }
20/07/2026 17:52:17 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /nope-xyz-1f46d4 HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Ac Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /nope-xyz-1f46d4 HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Ac Requête brute (extrait) GET /nope-xyz-1f46d4 HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 165, "payload_entropy": 5.222136469984879, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "300aa7ed8da70025928777f3847fa594", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/nope-xyz-1f46d4 HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "request_sample": "GET \/nope-xyz-1f46d4 HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/nope-xyz-1f46d4 HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "evidence": { "request_sample": "GET \/nope-xyz-1f46d4 HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/nope-xyz-1f46d4 HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f550ae4b21a8c09ece479cff919ef36bdeb1c300", "protocol_details": { "payload_preview": "GET \/nope-xyz-1f46d4 HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/nope-xyz-1f46d4 HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/nope-xyz-1f46d4 HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/nope-xyz-1f46d4 HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:21 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api/kernels HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/kernels HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /api/kernels HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 161, "payload_entropy": 5.1343204510155065, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1684ccbec1cbf3bf4ce21578e79d7ea0", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api\/kernels HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/api\/kernels HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/kernels HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/api\/kernels HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/kernels HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e96632db7ce49ffa561836078f46d8b5ef402452", "protocol_details": { "payload_preview": "GET \/api\/kernels HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api\/kernels HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api\/kernels HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/kernels HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:21 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /v1/kv/?recurse=true&keys=true HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, d Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /v1/kv/?recurse=true&keys=true HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, d Requête brute (extrait) GET /v1/kv/?recurse=true&keys=true HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 179, "payload_entropy": 5.2070265872040356, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f1b438a18dcd76eaee4b4ad58ec7f9c1", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/v1\/kv\/?recurse=true&keys=true HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, d", "request_sample": "GET \/v1\/kv\/?recurse=true&keys=true HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/v1\/kv\/?recurse=true&keys=true HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, d", "evidence": { "request_sample": "GET \/v1\/kv\/?recurse=true&keys=true HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/v1\/kv\/?recurse=true&keys=true HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, d", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c5bc8706cea89d3fe646b66aab22e5fa5ffb8c56", "protocol_details": { "payload_preview": "GET \/v1\/kv\/?recurse=true&keys=true HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, d", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/v1\/kv\/?recurse=true&keys=true HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, d", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/v1\/kv\/?recurse=true&keys=true HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, d", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/v1\/kv\/?recurse=true&keys=true HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, d", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:20 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /guacamole HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /guacamole HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Requête brute (extrait) GET /guacamole HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 159, "payload_entropy": 5.170341086296992, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e03cf638b08ce303885dcdcd1a36371c", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/guacamole HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "request_sample": "GET \/guacamole HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/guacamole HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "evidence": { "request_sample": "GET \/guacamole HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/guacamole HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ecdeed769776bb2f1c9dfae2269b7e6fff0f59f7", "protocol_details": { "payload_preview": "GET \/guacamole HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/guacamole HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/guacamole HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/guacamole HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:20 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /meshcentral HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /meshcentral HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /meshcentral HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 161, "payload_entropy": 5.14952778651679, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0d87148072c8952c89a777abbd83bd31", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/meshcentral HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/meshcentral HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/meshcentral HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/meshcentral HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/meshcentral HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bdca7f235cdb68303e8798f77b8afdec1c93062d", "protocol_details": { "payload_preview": "GET \/meshcentral HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/meshcentral HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/meshcentral HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/meshcentral HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:20 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api/v1/profile HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Acc Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/v1/profile HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Acc Requête brute (extrait) GET /api/v1/profile HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 164, "payload_entropy": 5.1557616588140585, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "60e0927ea7ebc5de378e857b777168cc", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api\/v1\/profile HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcc", "request_sample": "GET \/api\/v1\/profile HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/v1\/profile HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcc", "evidence": { "request_sample": "GET \/api\/v1\/profile HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/v1\/profile HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcc", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "76179c2ea19fb005b132099049f2d41886bb748d", "protocol_details": { "payload_preview": "GET \/api\/v1\/profile HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcc", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api\/v1\/profile HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcc", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api\/v1\/profile HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcc", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/v1\/profile HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcc", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:19 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /vnc_lite.html HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Acce Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /vnc_lite.html HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Acce Requête brute (extrait) GET /vnc_lite.html HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 163, "payload_entropy": 5.176438773506642, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0279e690531a705a427720a11a0ddeb9", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/vnc_lite.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "request_sample": "GET \/vnc_lite.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/vnc_lite.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "evidence": { "request_sample": "GET \/vnc_lite.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/vnc_lite.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "07648e7017459e6c4cfe4f274e81154de08ceb13", "protocol_details": { "payload_preview": "GET \/vnc_lite.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/vnc_lite.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/vnc_lite.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/vnc_lite.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:19 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /webmail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Pourquoi cette classification :* Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /webmail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Requête brute (extrait) GET /webmail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: /* Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 157, "payload_entropy": 5.194354961198715, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "76b7ce8e66710bb158e389c3acc50822", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "request_sample": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "evidence": { "request_sample": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1b48844a8a4763a81e17b8f5ff2575505f70e4fc", "protocol_details": { "payload_preview": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/webmail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: *\/", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:19 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /mail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /mail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Requête brute (extrait) GET /mail HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 154, "payload_entropy": 5.171620551470184, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c08cba4a13711954c56df1e9a666c07d", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\n", "request_sample": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "evidence": { "request_sample": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ea1bb7612a2e826a508e4461e9b9d699634d200d", "protocol_details": { "payload_preview": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/mail HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:18 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /package.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accep Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /package.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accep Requête brute (extrait) GET /package.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 162, "payload_entropy": 5.155224881484458, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0b39259c132501ac692769e84278fb35", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "request_sample": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "evidence": { "request_sample": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6c5e6b1ad2d5fb179b8fded4f1721650d1afdfda", "protocol_details": { "payload_preview": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/package.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:18 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: * Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: * Requête brute (extrait) GET /api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b226f70656e617069223a22332e30", "emulator_response_len": 222, "bytes_in": 158, "payload_entropy": 5.140383141852187, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e00c4fe7d8327b6ad4a1f509bbac4344", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "request_sample": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "evidence": { "request_sample": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6c17be69115b48906a6f8bcc558337e7585334ca", "protocol_details": { "payload_preview": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: *", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:18 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /v2/api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /v2/api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /v2/api-docs HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b226f70656e617069223a22332e30", "emulator_response_len": 222, "bytes_in": 161, "payload_entropy": 5.152832562762997, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "96cc8dc5b2969e8c31e8fb151fc79015", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "663b78f796d167bfa0133eed1b288742dca34da3", "protocol_details": { "payload_preview": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/v2\/api-docs HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ], "behavior_alert_count": 1, "behavior_priority": 84 }
20/07/2026 17:01:18 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /vnc.html HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: * Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /vnc.html HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: * Requête brute (extrait) GET /vnc.html HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 158, "payload_entropy": 5.168006736640796, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d5722f71fd3fd7115083e9a53851d8a4", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/vnc.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "request_sample": "GET \/vnc.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/vnc.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "evidence": { "request_sample": "GET \/vnc.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/vnc.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e359d93f232b74a08942ab5c8bb0ec1582ee5e01", "protocol_details": { "payload_preview": "GET \/vnc.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/vnc.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/vnc.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/vnc.html HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: *", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:17 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /.git/HEAD HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.git/HEAD HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Requête brute (extrait) GET /.git/HEAD HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 159, "payload_entropy": 5.16554671456879, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ee0a320bfbd980b3e8351e86ae6ca0a5", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "request_sample": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "evidence": { "request_sample": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "95da0fb97b4abd132c8d65d29d2d0f9fe3da2471", "protocol_details": { "payload_preview": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.git\/HEAD HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:17 UTC	TCP	8500 · CONSUL	consul	tor exit probe tor exit probe · via CONSUL:8500 · (commande & contrôle)	Élevée	Faible · 35
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /actuator/env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accep Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 46% Confiance classification 46% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 46 % — 6 signal(aux) capteur Protocole émulé 1 Signaux Tor Exit Hint Technique MITRE TA0011 Tactiques MITRE TA0011 User-Agent — Règles WAF — Payload (extrait) GET /actuator/env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accep Requête brute (extrait) GET /actuator/env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 162, "payload_entropy": 5.135611073034414, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 35, "tag_count": 6, "anomaly_count": 0, "campaign_key": "05ffe8bb367d85014736f1366731b882d5af8e23", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "confidence": 0.46, "classification_confidence": 0.46, "precision_score": 55, "precision_signals": [ "INT-TOR-exit-hint" ], "kb_rule_ids": [ "INT-TOR-exit-hint" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 46, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "35c2e0d2d297d90e844fd46d939008cc", "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 35 }, "payload_preview": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "request_sample": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "evidence": { "request_sample": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "34180d82f831029c5dbc676d133e68601cdd0993", "protocol_details": { "payload_preview": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "attack_vector": "tor exit probe \u00b7 via CONSUL:8500 \u00b7 (commande & contr\u00f4le)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 46 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 46 % \u2014 via CONSUL", "confidence_pct": 46, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 35 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 35, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": [ "INT-TOR-exit-hint" ], "tags_summary_labels_fr": [ "Tor Exit Hint" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "tor exit probe \u00b7 via CONSUL:8500 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccep", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 46 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 46 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe", "tor_exit_probe" ] }
20/07/2026 17:01:17 UTC	TCP	8500 · CONSUL	consul	tor exit probe tor exit probe · via CONSUL:8500 · (commande & contrôle)	Élevée	Faible · 35
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /actuator/health HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Ac Pourquoi cette classification : Type « tor_exit_probe » (signaux protocolaires) · confiance 46% Confiance classification 46% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 46 % — 6 signal(aux) capteur Protocole émulé 1 Signaux Tor Exit Hint Technique MITRE TA0011 Tactiques MITRE TA0011 User-Agent — Règles WAF — Payload (extrait) GET /actuator/health HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Ac Requête brute (extrait) GET /actuator/health HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f766e642e737072696e672d626f6f742e6163747561746f722e76332b6a736f6e0d0a436f6e74656e742d4c656e6774683a2034390d0a436f6e6e656374696f", "emulator_response_len": 189, "bytes_in": 165, "payload_entropy": 5.143946011669833, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 62, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 35, "tag_count": 6, "anomaly_count": 0, "campaign_key": "05ffe8bb367d85014736f1366731b882d5af8e23", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "confidence": 0.46, "classification_confidence": 0.46, "precision_score": 55, "precision_signals": [ "INT-TOR-exit-hint" ], "kb_rule_ids": [ "INT-TOR-exit-hint" ], "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 46, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "796edf116feeb3389975a5be852bfb83", "path_pattern_hash": "d2d40d620e587c49ef0af866b893b1d5" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 35 }, "payload_preview": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "request_sample": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "evidence": { "request_sample": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e16212a03f67188947b3069e707523a54e5da660", "protocol_details": { "payload_preview": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "attack_vector": "tor exit probe \u00b7 via CONSUL:8500 \u00b7 (commande & contr\u00f4le)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 46 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "classification_reason_label_fr": "Type \u00ab tor_exit_probe \u00bb (signaux protocolaires) \u00b7 confiance 46%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 46 % \u2014 via CONSUL", "confidence_pct": 46, "confidence_breakdown": { "waf": 8, "classification": 62, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 35 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 35, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": [ "INT-TOR-exit-hint" ], "tags_summary_labels_fr": [ "Tor Exit Hint" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "tor exit probe \u00b7 via CONSUL:8500 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/actuator\/health HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAc", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 46 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": "Confiance 46 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe", "tor_exit_probe" ] }
20/07/2026 17:01:16 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /settings.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Acce Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /settings.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Acce Requête brute (extrait) GET /settings.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 163, "payload_entropy": 5.120093086113792, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "058708fe0c61a69f88d484af855c3dd9", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "request_sample": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "evidence": { "request_sample": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2d57978b3351fb8f97926c76e44961b81efd481d", "protocol_details": { "payload_preview": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/settings.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAcce", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:16 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /.env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Requête brute (extrait) GET /.env HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 154, "payload_entropy": 5.129692136898174, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "601e6c6cffcc3c29a8f6cbc1629296a6", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\n", "request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "evidence": { "request_sample": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f1107736c750d567504429b3a77639a36c00582a", "protocol_details": { "payload_preview": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.env HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:16 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /.git/config HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /.git/config HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /.git/config HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 161, "payload_entropy": 5.128608124689145, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 6, "anomaly_count": 0, "campaign_key": "2c2f44214c505f03c7f44871397dc98135e03457", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cdc0896b4e71c7355df735e073022536", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f092eb5304c9003eb00f98119186bec82179a397", "protocol_details": { "payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe", "redis_config_probe" ] }
20/07/2026 17:01:15 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: * Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: * Requête brute (extrait) GET /api/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 158, "payload_entropy": 5.142013441543261, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4729507fe7919e06055a5eefa9bd1e85", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "request_sample": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "evidence": { "request_sample": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9de379f4cb2b2f14045569db0a30e3645997bd21", "protocol_details": { "payload_preview": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: *", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:15 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /info.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /info.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Requête brute (extrait) GET /info.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 159, "payload_entropy": 5.150513006860846, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "54d1ae0a1ef1018f99a8a9588ddf71b1", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: ", "request_sample": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "evidence": { "request_sample": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "34c36955f0ac9327f01506a7da317e049003e406", "protocol_details": { "payload_preview": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/info.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:15 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /config.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 6 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /config.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /config.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 161, "payload_entropy": 5.149527786516789, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 6, "anomaly_count": 0, "campaign_key": "2c2f44214c505f03c7f44871397dc98135e03457", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "79e98d1a07114eca2acf047962bf5fcd", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0faba8cdcbec45e1ecf13905acf2f381a188a4e5", "protocol_details": { "payload_preview": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/config.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 6 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe", "redis_config_probe" ] }
20/07/2026 17:01:14 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api/devices HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/devices HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /api/devices HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a7b2264657669636573223a5b5d2c2274", "emulator_response_len": 137, "bytes_in": 161, "payload_entropy": 5.131536501099151, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "497d6244d73aa765b6268da14260b9d0", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "171858fc045bc5c53bc801ed09c5244f48c380b9", "protocol_details": { "payload_preview": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/devices HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:14 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api/firmware/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/firmware/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Requête brute (extrait) GET /api/firmware/info HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 167, "payload_entropy": 5.182854006680233, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8bd6f3397d745a1751be84d821a7c034", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\n", "request_sample": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "evidence": { "request_sample": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4bc7475eeca34de9ac4df131fb3a0fdd222cb0cb", "protocol_details": { "payload_preview": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/firmware\/info HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:14 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /api/status HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /api/status HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: Requête brute (extrait) GET /api/status HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 160, "payload_entropy": 5.138274230551065, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "84b6d0cd467e9ef0985f75ed05130f21", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "request_sample": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "evidence": { "request_sample": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d4d64f649ab8a4c03a5c8d78f8674dd01299a12a", "protocol_details": { "payload_preview": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/api\/status HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept:", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:13 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /status.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /status.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept Requête brute (extrait) GET /status.json HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 161, "payload_entropy": 5.147363093686996, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1bbe80c6d75358017aa114acba93203a", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "request_sample": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "evidence": { "request_sample": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ca79278aa6cc547aafb4232059f5c62e8851e98b", "protocol_details": { "payload_preview": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/status.json HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:13 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /metrics HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Pourquoi cette classification :* Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Requête brute (extrait) GET /metrics HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: /* Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020", "emulator_response_len": 154, "bytes_in": 157, "payload_entropy": 5.143297557179585, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5f6bde2e1cb1a61526eebefc1504490a", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "evidence": { "request_sample": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d14120f192c089fa03c0c4c9caee6d78e18d3722", "protocol_details": { "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/metrics HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: *\/", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:13 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET /healthz HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Pourquoi cette classification :* Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET /healthz HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Requête brute (extrait) GET /healthz HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: /* Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 157, "payload_entropy": 5.158211190238794, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "356e6142867942187399aa1de7ae4ad9", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "request_sample": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "evidence": { "request_sample": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bc051ca510aa67393b8925a46b7b0a6d447e0279", "protocol_details": { "payload_preview": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/healthz HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: *\/", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }
20/07/2026 17:01:12 UTC	TCP	8500 · CONSUL	consul	consul probe consul probe · via CONSUL:8500 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL WAF — Recommandation Surveiller Tags consul_emulated consul_payload consul_probe http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8500 Chemin / cible — Service CONSUL Payload GET / HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Conn Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Conn Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8500 User-Agent: python-requests/2.32.5 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74", "emulator_response_len": 138, "bytes_in": 150, "payload_entropy": 5.138577711416924, "port_category": "registered", "org": "Datacamp Limited", "service": "consul", "app_proto": "consul", "asn": 212238, "country": "ES", "dst_port": 8500, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25 }, "risk_score": 21, "tag_count": 5, "anomaly_count": 0, "campaign_key": "be5b696efcb2e9dad7694a56dc33e24e3ff135e2", "event_fingerprint": "da5f12ea5f2f6e772f68c2f73e3d9d6c1b49db5f", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ES", "asn": 212238, "org": "Datacamp Limited", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0922be1539baa8a8413ed8d566ae37a6", "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8500, "service": "consul", "service_name": "consul", "risk_score": 21 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: keep-alive\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "738917205be8d63d29d685bf22329c0431d13cb4", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 25, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul", "service_label_fr": "CONSUL", "dst_port": 8500, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "port": 8500, "service": "consul", "service_label_fr": "CONSUL" }, "attack_vector": "consul probe \u00b7 via CONSUL:8500 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8500\r\nUser-Agent: python-requests\/2.32.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConn", "target_port_label": "8500 \u00b7 CONSUL", "emulator_service": "consul", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul", "service_banner": "honeypot-consul", "service_os": "linux", "dst_port": "8500" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_emulated", "consul_payload", "consul_probe", "http_get_probe", "net_consul_probe" ] }

45.134.213.204

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence