45.148.10.175

{
    "protocol_emulated": true,
    "emulator_response": "2b4f4b20504f503320686f6e6579706f742072656164790d0a",
    "emulator_response_len": 25,
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": "pop3",
    "app_proto": "pop3",
    "asn": 48090,
    "country": "NL",
    "dst_port": 110,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "68f672d2281c8a5160e877971bb68ba261be984b",
    "event_fingerprint": "8d5f083aa812a6762c3b48b8375cd32260924478",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab pop3_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "pop3",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "44d5bece51c65fa33908cf3d76b6745a"
    },
    "target_context": {
        "dst_port": 110,
        "service": "pop3",
        "service_name": "pop3",
        "risk_score": 45
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab pop3_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "51b0e0c30873cd8083cea78dbfd94163dad1b801",
    "protocol_details": {
        "pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
        "payload_preview": "\u0005\u0001\u0000",
        "port": 110,
        "service": "pop3",
        "service_label_fr": "POP3"
    },
    "attack_vector": "pop3 probe \u00b7 via POP3:110 \u00b7 (sonde \/ probe)",
    "target_port_label": "110 \u00b7 POP3",
    "emulator_service": "pop3",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab pop3_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab pop3_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "pop3",
        "service_label_fr": "POP3",
        "dst_port": 110,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-pop3",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
            "payload_preview": "\u0005\u0001\u0000",
            "port": 110,
            "service": "pop3",
            "service_label_fr": "POP3"
        },
        "attack_vector": "pop3 probe \u00b7 via POP3:110 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "110 \u00b7 POP3",
        "emulator_service": "pop3",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "pop3",
        "service_banner": "honeypot-pop3",
        "service_os": "linux",
        "dst_port": "110"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_pop3_probe",
        "pop3_emulated",
        "socks5_greeting"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "2b4f4b20504f503320686f6e6579706f742072656164790d0a",
    "emulator_response_len": 25,
    "bytes_in": 166,
    "payload_entropy": 5.00117579719714,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": "pop3",
    "app_proto": "pop3",
    "asn": 48090,
    "country": "NL",
    "dst_port": 110,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 38,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "0bc29430209a1501e4a4048f59725d53efecdcd6",
    "event_fingerprint": "8d5f083aa812a6762c3b48b8375cd32260924478",
    "classification_reason": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 38
    },
    "named_classification_skipped": true,
    "named_candidate": "pop3_probe",
    "service_name": "pop3",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1f80db49e48a030bf11d59fe1a646d32",
        "path_pattern_hash": "dc4164b66ff59a3b1d171afce3368aeb"
    },
    "target_context": {
        "dst_port": 110,
        "service": "pop3",
        "service_name": "pop3",
        "risk_score": 38
    },
    "payload_preview": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "evidence": {
        "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "classification_reason": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "68b40f44deffde0eb59c6e623080ac4a0ce888f5",
    "protocol_details": {
        "pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
        "payload_preview": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "port": 110,
        "service": "pop3",
        "service_label_fr": "POP3"
    },
    "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "attack_vector": "port 110 tcp \u00b7 via POP3:110 \u00b7 (sonde \/ probe)",
    "target_port_label": "110 \u00b7 POP3",
    "emulator_service": "pop3",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "pop3",
        "service_label_fr": "POP3",
        "dst_port": 110,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-pop3",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
            "payload_preview": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
            "port": 110,
            "service": "pop3",
            "service_label_fr": "POP3"
        },
        "attack_vector": "port 110 tcp \u00b7 via POP3:110 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "target_port_label": "110 \u00b7 POP3",
        "emulator_service": "pop3",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "pop3",
        "service_banner": "honeypot-pop3",
        "service_os": "linux",
        "dst_port": "110"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_pop3_probe",
        "pop3_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "2b4f4b20504f503320686f6e6579706f742072656164790d0a",
    "emulator_response_len": 25,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": "pop3",
    "app_proto": "pop3",
    "asn": 48090,
    "country": "NL",
    "dst_port": 110,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 38,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "0bc29430209a1501e4a4048f59725d53efecdcd6",
    "event_fingerprint": "8d5f083aa812a6762c3b48b8375cd32260924478",
    "classification_reason": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 38
    },
    "named_classification_skipped": true,
    "named_candidate": "pop3_probe",
    "service_name": "pop3",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "dc4164b66ff59a3b1d171afce3368aeb"
    },
    "target_context": {
        "dst_port": 110,
        "service": "pop3",
        "service_name": "pop3",
        "risk_score": 38
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "92905bc731f5997d91db958dfa59f6c569432dbe",
    "protocol_details": {
        "pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
        "port": 110,
        "service": "pop3",
        "service_label_fr": "POP3"
    },
    "attack_vector": "port 110 tcp \u00b7 via POP3:110 \u00b7 (sonde \/ probe)",
    "target_port_label": "110 \u00b7 POP3",
    "emulator_service": "pop3",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_110_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "pop3",
        "service_label_fr": "POP3",
        "dst_port": 110,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-pop3",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "pop3_auth_fr": "Sonde protocole POP3 (USER\/PASS)",
            "port": 110,
            "service": "pop3",
            "service_label_fr": "POP3"
        },
        "attack_vector": "port 110 tcp \u00b7 via POP3:110 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "110 \u00b7 POP3",
        "emulator_service": "pop3",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "pop3",
        "service_banner": "honeypot-pop3",
        "service_os": "linux",
        "dst_port": "110"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_pop3_probe",
        "pop3_emulated"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": null,
    "app_proto": null,
    "asn": 48090,
    "country": "NL",
    "dst_port": 92,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "b29703880b2b6d9d307297e1b20870fd403ba62c",
    "event_fingerprint": "328642811218230d8e10d8a6005cafa993d47323",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 92,
        "risk_score": 35
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dfa139a8a05f1e38e42a1590291a7ebdcf34dde4",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 92
    },
    "attack_vector": "proxy probe \u00b7 port 92 \u00b7 (sonde \/ probe)",
    "target_port_label": "92",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 92,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 92
        },
        "attack_vector": "proxy probe \u00b7 port 92 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "92",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "92"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:92"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks5_greeting"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "4c280bb0dc18e626d42a69b31352357240b03ab5",
    "http_target_hash": "515c590ed9ef7b369c8544424b69eb40f98b4bf6",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 166,
    "payload_entropy": 5.00117579719714,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": "http",
    "app_proto": "http",
    "asn": 48090,
    "country": "NL",
    "dst_port": 92,
    "risk_waf": 8,
    "risk_classification": 16,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 16,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "29b5cfaab7f68f31fec833f43211833ef4aca692",
    "event_fingerprint": "6abe6391380b59cdeb3d4d8cf80e696bcc6df77e",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "1f80db49e48a030bf11d59fe1a646d32",
        "path_pattern_hash": "d4316912fc1c8cdb6a3ce8d39278b90e"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 92,
        "service": "http",
        "service_name": "http",
        "risk_score": 35
    },
    "payload_preview": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "method": "GET",
    "path": "\/judge",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
    "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "evidence": {
        "method": "GET",
        "path": "\/judge",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
        "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 16,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "256383db0893abee9492690caf3fa40f2fbdd5c2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/judge",
        "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 92,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "attack_vector": "http \u00b7 via HTTP:92 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/judge",
    "target_port_label": "92 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 61 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 16,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 92,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/judge",
            "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 92,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:92 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/judge",
        "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "target_port_label": "92 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 61 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "92"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:92"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_absolute_uri",
        "http_ua_suspicious"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": null,
    "app_proto": null,
    "asn": 48090,
    "country": "NL",
    "dst_port": 92,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "52354dfd4c48688d1a3ad9a2ca169385802d1410",
    "event_fingerprint": "d6376266bd0221ab1950d2c72d9966018e8b6776",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 92,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1a4f91729a5ec79082593fd23d02e8daa9d124e3",
    "protocol_details": {
        "port": 92
    },
    "attack_vector": "Sonde port \u00b7 port 92 \u00b7 (sonde \/ probe)",
    "target_port_label": "92",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 92,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 92
        },
        "attack_vector": "Sonde port \u00b7 port 92 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "92",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "92"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "4c280bb0dc18e626d42a69b31352357240b03ab5",
    "http_target_hash": "515c590ed9ef7b369c8544424b69eb40f98b4bf6",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 166,
    "payload_entropy": 5.00117579719714,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": "http",
    "app_proto": "http",
    "asn": 48090,
    "country": "NL",
    "dst_port": 99,
    "risk_waf": 8,
    "risk_classification": 16,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 16,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "ccaa451c22bb55c4c46b3f185225be5d74af0822",
    "event_fingerprint": "1240096015f9b5d753ab52d39aa44e3aab9b0578",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "1f80db49e48a030bf11d59fe1a646d32",
        "path_pattern_hash": "d4316912fc1c8cdb6a3ce8d39278b90e"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 99,
        "service": "http",
        "service_name": "http",
        "risk_score": 35
    },
    "payload_preview": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "method": "GET",
    "path": "\/judge",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
    "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "evidence": {
        "method": "GET",
        "path": "\/judge",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
        "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 16,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "721db9568423bbb7402e572342800e02f6d22cfd",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/judge",
        "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 99,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "attack_vector": "http \u00b7 via HTTP:99 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/judge",
    "target_port_label": "99 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 61 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 16,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 99,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/judge",
            "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 99,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:99 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/judge",
        "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "target_port_label": "99 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 61 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "99"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:99"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_absolute_uri",
        "http_ua_suspicious"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": null,
    "app_proto": null,
    "asn": 48090,
    "country": "NL",
    "dst_port": 99,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "d5cc427a2bfb107f989adb96c371f13b73ed8871",
    "event_fingerprint": "052b9868a671133684e98088c113ff0953bbfbad",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 99,
        "risk_score": 35
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cd020d9b3c5b7f77239f446d02d696e8be7d9255",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 99
    },
    "attack_vector": "proxy probe \u00b7 port 99 \u00b7 (sonde \/ probe)",
    "target_port_label": "99",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 99,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 99
        },
        "attack_vector": "proxy probe \u00b7 port 99 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "99",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "99"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks5_greeting"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": null,
    "app_proto": null,
    "asn": 48090,
    "country": "NL",
    "dst_port": 99,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "ab68ee9910c99ccb4bcb051e8bd2a0a5d97d9dcc",
    "event_fingerprint": "a99f790358b1839e53a756724141eb5f5b2781eb",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 99,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b76bca9a050000fd47c2ec991be83c85a78c2b10",
    "protocol_details": {
        "port": 99
    },
    "attack_vector": "Sonde port \u00b7 port 99 \u00b7 (sonde \/ probe)",
    "target_port_label": "99",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 99,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 99
        },
        "attack_vector": "Sonde port \u00b7 port 99 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "99",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "99"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "4c280bb0dc18e626d42a69b31352357240b03ab5",
    "http_target_hash": "515c590ed9ef7b369c8544424b69eb40f98b4bf6",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 166,
    "payload_entropy": 5.00117579719714,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": "http",
    "app_proto": "http",
    "asn": 48090,
    "country": "NL",
    "dst_port": 91,
    "risk_waf": 8,
    "risk_classification": 16,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 16,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "6abfee34b23670cc4eef658dbe89560b6c013422",
    "event_fingerprint": "246a6ad232e77bb4feded83ff84dbc72f7ae93fc",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "1f80db49e48a030bf11d59fe1a646d32",
        "path_pattern_hash": "d4316912fc1c8cdb6a3ce8d39278b90e"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 91,
        "service": "http",
        "service_name": "http",
        "risk_score": 35
    },
    "payload_preview": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "method": "GET",
    "path": "\/judge",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
    "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "evidence": {
        "method": "GET",
        "path": "\/judge",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
        "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 16,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "50173815e3665685462247bddad998cccda4d5ec",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/judge",
        "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 91,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "attack_vector": "http \u00b7 via HTTP:91 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/judge",
    "target_port_label": "91 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 61 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 16,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 91,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/judge",
            "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 91,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:91 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/judge",
        "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "target_port_label": "91 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 61 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "91"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:91"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_absolute_uri",
        "http_ua_suspicious"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": null,
    "app_proto": null,
    "asn": 48090,
    "country": "NL",
    "dst_port": 91,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "e7c1e7ff92ce6db2e81fd3b039218caba5ec9448",
    "event_fingerprint": "a62a0d62b0b9b28e9fd9e7059e006106d3678d91",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 91,
        "risk_score": 35
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a4c5ce38a9a772f155461c2b814d58c19a10fe8c",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 91
    },
    "attack_vector": "proxy probe \u00b7 port 91 \u00b7 (sonde \/ probe)",
    "target_port_label": "91",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 91,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 91
        },
        "attack_vector": "proxy probe \u00b7 port 91 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "91",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "91"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks5_greeting"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": null,
    "app_proto": null,
    "asn": 48090,
    "country": "NL",
    "dst_port": 91,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "7676a1f53b270a7bcd1b317dea18327cfbd88108",
    "event_fingerprint": "3183d6b5c54a64a289ec6257b66a5dc7573ab5c6",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 91,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c6ba5b24a0cbac2626d6a6806a578f52380f35d7",
    "protocol_details": {
        "port": 91
    },
    "attack_vector": "Sonde port \u00b7 port 91 \u00b7 (sonde \/ probe)",
    "target_port_label": "91",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 91,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 91
        },
        "attack_vector": "Sonde port \u00b7 port 91 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "91",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "91"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": null,
    "app_proto": null,
    "asn": 48090,
    "country": "NL",
    "dst_port": 90,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "cc78786e5dc535a7ad9f420ac4dc9b69c5ee0f2f",
    "event_fingerprint": "49a2e3511a89c8ccc0867977fc698194f3276a16",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 90,
        "risk_score": 35
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5d827b045c88c11e6c5928a846e800f6d089eea9",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 90
    },
    "attack_vector": "proxy probe \u00b7 port 90 \u00b7 (sonde \/ probe)",
    "target_port_label": "90",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 90,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 90
        },
        "attack_vector": "proxy probe \u00b7 port 90 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "90",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "90"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:90"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks5_greeting"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
    "http_host_hash": "4c280bb0dc18e626d42a69b31352357240b03ab5",
    "http_target_hash": "515c590ed9ef7b369c8544424b69eb40f98b4bf6",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 166,
    "payload_entropy": 5.00117579719714,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": "http",
    "app_proto": "http",
    "asn": 48090,
    "country": "NL",
    "dst_port": 90,
    "risk_waf": 8,
    "risk_classification": 16,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 16,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "724dcb508fb94db60ce63c42404adcdac94c73f5",
    "event_fingerprint": "5e97f2c17f036b072cf351097308f5282304f5b5",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
        "payload_hash": "1f80db49e48a030bf11d59fe1a646d32",
        "path_pattern_hash": "d4316912fc1c8cdb6a3ce8d39278b90e"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 90,
        "service": "http",
        "service_name": "http",
        "risk_score": 35
    },
    "payload_preview": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "method": "GET",
    "path": "\/judge",
    "user_agent": "Go-http-client\/1.1",
    "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
    "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "evidence": {
        "method": "GET",
        "path": "\/judge",
        "user_agent": "Go-http-client\/1.1",
        "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
        "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 16,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fdd846f57b305116e4c77ca3c149013a1d297994",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/judge",
        "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
        "http_user_agent": "Go-http-client\/1.1",
        "port": 90,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "attack_vector": "http \u00b7 via HTTP:90 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/judge",
    "target_port_label": "90 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 61 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 61%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 16,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 90,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/judge",
            "request_line": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1",
            "http_user_agent": "Go-http-client\/1.1",
            "port": 90,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:90 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/judge",
        "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "target_port_label": "90 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 61 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "90"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:90"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_absolute_uri",
        "http_ua_suspicious"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": null,
    "app_proto": null,
    "asn": 48090,
    "country": "NL",
    "dst_port": 90,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4f341c8e0da56c076d73eb4c165678872f0695ee",
    "event_fingerprint": "0cddc6e197f41c62c9403b7995b1e5f784df90e1",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 90,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5591dabbdabf60219c44b2abb723f264526676cd",
    "protocol_details": {
        "port": 90
    },
    "attack_vector": "Sonde port \u00b7 port 90 \u00b7 (sonde \/ probe)",
    "target_port_label": "90",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 90,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 90
        },
        "attack_vector": "Sonde port \u00b7 port 90 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "90",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "90"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "6e82000c0a104142434445464748494a",
    "emulator_response_len": 16,
    "bytes_in": 166,
    "payload_entropy": 5.00117579719714,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": "kerberos",
    "app_proto": "kerberos",
    "asn": 48090,
    "country": "NL",
    "dst_port": 88,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "fe65256267055ff3741cb3e41e97d623e066dba9",
    "event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
    "classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 15,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "kerberos",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1f80db49e48a030bf11d59fe1a646d32",
        "path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6"
    },
    "target_context": {
        "dst_port": 88,
        "service": "kerberos",
        "service_name": "kerberos",
        "risk_score": 0
    },
    "payload_preview": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "evidence": {
        "request_sample": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2b7263da9e5127d8793c32ed0fb80ee0855cf682",
    "protocol_details": {
        "payload_preview": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "port": 88,
        "service": "kerberos",
        "service_label_fr": "KERBEROS"
    },
    "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
    "attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
    "target_port_label": "88 \u00b7 KERBEROS",
    "emulator_service": "kerberos",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 15,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "kerberos",
        "service_label_fr": "KERBEROS",
        "dst_port": 88,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-kerberos",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
            "port": 88,
            "service": "kerberos",
            "service_label_fr": "KERBEROS"
        },
        "attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET http:\/\/proxy.flarevpn.digital:8080\/judge HTTP\/1.1\r\nHost: proxy.flarevpn.digital:8080\r\nUser-Agent: Go-http-client\/1.1\r\nAccept",
        "target_port_label": "88 \u00b7 KERBEROS",
        "emulator_service": "kerberos",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "kerberos",
        "service_banner": "honeypot-kerberos",
        "service_os": "linux",
        "dst_port": "88"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "6e82000c0a104142434445464748494a",
    "emulator_response_len": 16,
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": "kerberos",
    "app_proto": "kerberos",
    "asn": 48090,
    "country": "NL",
    "dst_port": 88,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "2eae98a942196fe6bf08121fd3b0cbacefd26338",
    "event_fingerprint": "1a67d7a60a88afd5c5bd15d381c7d0ef67f88058",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "kerberos",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 88,
        "service": "kerberos",
        "service_name": "kerberos",
        "risk_score": 35
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b5d8d24b830bd0502eed65de79e7413d5f052593",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 88,
        "service": "kerberos",
        "service_label_fr": "KERBEROS"
    },
    "attack_vector": "proxy probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
    "target_port_label": "88 \u00b7 KERBEROS",
    "emulator_service": "kerberos",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "kerberos",
        "service_label_fr": "KERBEROS",
        "dst_port": 88,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-kerberos",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 88,
            "service": "kerberos",
            "service_label_fr": "KERBEROS"
        },
        "attack_vector": "proxy probe \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "88 \u00b7 KERBEROS",
        "emulator_service": "kerberos",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "kerberos",
        "service_banner": "honeypot-kerberos",
        "service_os": "linux",
        "dst_port": "88"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_proxy_probe",
        "socks5_greeting"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "6e82000c0a104142434445464748494a",
    "emulator_response_len": 16,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Techoff Srv Limited",
    "service": "kerberos",
    "app_proto": "kerberos",
    "asn": 48090,
    "country": "NL",
    "dst_port": 88,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "fe65256267055ff3741cb3e41e97d623e066dba9",
    "event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
    "classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "kerberos",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 48090,
        "org": "Techoff Srv Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6"
    },
    "target_context": {
        "dst_port": 88,
        "service": "kerberos",
        "service_name": "kerberos",
        "risk_score": 0
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ebeb7af8f30f380ff10b2e6fd901d56429d2e157",
    "protocol_details": {
        "port": 88,
        "service": "kerberos",
        "service_label_fr": "KERBEROS"
    },
    "attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
    "target_port_label": "88 \u00b7 KERBEROS",
    "emulator_service": "kerberos",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "kerberos",
        "service_label_fr": "KERBEROS",
        "dst_port": 88,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-kerberos",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 88,
            "service": "kerberos",
            "service_label_fr": "KERBEROS"
        },
        "attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "88 \u00b7 KERBEROS",
        "emulator_service": "kerberos",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "kerberos",
        "service_banner": "honeypot-kerberos",
        "service_os": "linux",
        "dst_port": "88"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}