45.153.34.89

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 1,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
    "http_target_hash": "f046ea76a7cf42972dc59184928789e002515b0e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 194,
    "payload_entropy": 5.0384489600608555,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8090,
    "risk_waf": 44,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.5,
    "risk_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 43,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "955fe1ce7220d34d3941615234d87d91dafbcbd4",
    "event_fingerprint": "4d9582d27e421b30d5700f125aa936413af64a18",
    "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 43,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "136766c942067957dda7cc34c306ffee",
        "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
    },
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 43
    },
    "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "method": "GET",
    "path": "\/",
    "query_string": "pc_probe=9fcc4fea20118932-bet4d8",
    "waf_tags": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d8 HTTP\/1.1",
    "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "query_string": "pc_probe=9fcc4fea20118932-bet4d8",
        "waf_tags": [
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d8 HTTP\/1.1",
        "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4827ce8c324d07f3bf2d224b6ea2db74525b1630",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d8 HTTP\/1.1",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "attack_vector": "port scan syn \u00b7 via HTTP:8090 \u00b7 (reconnaissance)",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (38 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 44,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 43,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 43,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d8 HTTP\/1.1",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8090 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d8 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 107,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 107,
    "scan_velocity_ports_per_s": 99.35,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 38,
    "multi_protocol_sample": [
        "bitcoin",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx",
        "kerberos"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "http_absolute_uri",
        "http_no_ua",
        "net_port_scan_fast"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "6e82000c0a104142434445464748494a",
    "emulator_response_len": 16,
    "bytes_in": 194,
    "payload_entropy": 5.023838306163244,
    "port_category": "well_known",
    "org": "TechTies Inc.",
    "service": "kerberos",
    "app_proto": "kerberos",
    "asn": 197170,
    "country": "NL",
    "dst_port": 88,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "a0bbcb32db0850167ba7a2ea9d9008ae93140003",
    "event_fingerprint": "913d44813db075acdef68e978cb3225e3e208a9e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "kerberos",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "26dbb865997a751c39cd7028663dafaa",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 88,
        "service": "kerberos",
        "service_name": "kerberos",
        "risk_score": 42
    },
    "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "evidence": {
        "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4df134fc7cd0d134130da550f9227380f4e51db3",
    "protocol_details": {
        "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "port": 88,
        "service": "kerberos",
        "service_label_fr": "KERBEROS"
    },
    "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "attack_vector": "port scan syn \u00b7 via KERBEROS:88 \u00b7 (reconnaissance)",
    "target_port_label": "88 \u00b7 KERBEROS",
    "emulator_service": "kerberos",
    "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via KERBEROS \u2014 multi-protocole (38 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "kerberos",
        "service_label_fr": "KERBEROS",
        "dst_port": 88,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-kerberos",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
            "port": 88,
            "service": "kerberos",
            "service_label_fr": "KERBEROS"
        },
        "attack_vector": "port scan syn \u00b7 via KERBEROS:88 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dp HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "target_port_label": "88 \u00b7 KERBEROS",
        "emulator_service": "kerberos",
        "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "kerberos",
        "service_banner": "honeypot-kerberos",
        "service_os": "linux",
        "dst_port": "88"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 107,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 107,
    "scan_velocity_ports_per_s": 98.86,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 38,
    "multi_protocol_sample": [
        "bitcoin",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx",
        "kerberos"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
    "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 98,
    "payload_entropy": 4.732491723718083,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8140,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e590c28662c06b1f70e9b122ed71666993a810ed",
    "event_fingerprint": "6a07d420681a2d8bc31cd38e2e484fa540f81546",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
        "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
    },
    "target_context": {
        "dst_port": 8140,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
    "method": "CONNECT",
    "path": "check.proxypool.sh:443",
    "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
    "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
    "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
    "evidence": {
        "method": "CONNECT",
        "path": "check.proxypool.sh:443",
        "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
        "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
        "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "59ee3ec3f89d676656afab5b0542cb290217c375",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "check.proxypool.sh:443",
        "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
        "port": 8140,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
    "attack_vector": "port scan syn \u00b7 via HTTP:8140 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
    "target_port_label": "8140 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (38 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8140,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "check.proxypool.sh:443",
            "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
            "port": 8140,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8140 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
        "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
        "target_port_label": "8140 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8140"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 108,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 108,
    "scan_velocity_ports_per_s": 99.3,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 38,
    "multi_protocol_sample": [
        "bitcoin",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx",
        "kerberos"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_port_scan_fast"
    ]
}

{
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 5678,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 8,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "ec21dce4c8efece9f2d6b8e0c55496bd374acff6",
    "event_fingerprint": "80144f6ecfdb45c9655a3f7a5d146ac42facc557",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f6d7f72f6464e12cbf41f58650886486",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 5678,
        "risk_score": 42
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2be27a7ae3a983147bb455d436d02d217b271f73",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "port": 5678
    },
    "evidence_snippet": "\ufffd\"\r\ufffdN",
    "attack_vector": "port scan syn \u00b7 port 5678 \u00b7 (reconnaissance)",
    "target_port_label": "5678",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (39 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 8,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 5678,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
            "port": 5678
        },
        "attack_vector": "port scan syn \u00b7 port 5678 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\"\r\ufffdN",
        "target_port_label": "5678",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "5678"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 109,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 109,
    "scan_velocity_ports_per_s": 100,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 39,
    "multi_protocol_sample": [
        "bitcoin",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx",
        "kerberos"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "socks4_greeting"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 4153,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 8,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "d14d08bb9e77aaa0eab1af924efca62599af4aec",
    "event_fingerprint": "bc23b7d6a5b902e138adb39177136f03cd03737a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0567"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SOCKS5 greeting"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0567"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 4153,
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7814861da389e296c6ece84679cdc03da5fb3315",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 4153
    },
    "attack_vector": "port scan syn \u00b7 port 4153 \u00b7 (reconnaissance)",
    "target_port_label": "4153",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (39 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 8,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4153,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 4153
        },
        "attack_vector": "port scan syn \u00b7 port 4153 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "4153",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4153"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 109,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 109,
    "scan_velocity_ports_per_s": 99.83,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 39,
    "multi_protocol_sample": [
        "bitcoin",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx",
        "kerberos"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_port_scan_fast",
        "socks5_greeting"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2036370d0a0d0a7b22436f6e666967223a7b224461746163656e746572223a22646331227d2c224d656d626572223a7b224e616d65223a22686f6e6579706f74",
    "emulator_response_len": 138,
    "bytes_in": 194,
    "payload_entropy": 5.023161319835888,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "consul",
    "app_proto": "consul",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8500,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "5efc41333713044f7c1cf6caa93acb47a3c97a0f",
    "event_fingerprint": "df9e361f9de4dc21bcd4614b134d3aa2563c6dba",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "consul",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "365b5024b228821b07c1510b8a8f007c",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 8500,
        "service": "consul",
        "service_name": "consul",
        "risk_score": 42
    },
    "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4de HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4de HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4de HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "evidence": {
        "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4de HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4de HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "71b70e35e8411c9fa3d7592c613f7ff096a6c093",
    "protocol_details": {
        "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4de HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "port": 8500,
        "service": "consul",
        "service_label_fr": "CONSUL"
    },
    "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4de HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "attack_vector": "port scan syn \u00b7 via CONSUL:8500 \u00b7 (reconnaissance)",
    "target_port_label": "8500 \u00b7 CONSUL",
    "emulator_service": "consul",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via CONSUL \u2014 multi-protocole (40 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "consul",
        "service_label_fr": "CONSUL",
        "dst_port": 8500,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-consul",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4de HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
            "port": 8500,
            "service": "consul",
            "service_label_fr": "CONSUL"
        },
        "attack_vector": "port scan syn \u00b7 via CONSUL:8500 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4de HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "target_port_label": "8500 \u00b7 CONSUL",
        "emulator_service": "consul",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "consul",
        "service_banner": "honeypot-consul",
        "service_os": "linux",
        "dst_port": "8500"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 110,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 110,
    "scan_velocity_ports_per_s": 100.31,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 40,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "consul_emulated",
        "consul_payload",
        "consul_probe",
        "net_port_scan_fast"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 1,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
    "http_target_hash": "c4bc0a77437de67112300e0bb2500650f60b27d6",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 194,
    "payload_entropy": 5.020357336327211,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8989,
    "risk_waf": 44,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.5,
    "risk_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 43,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "b6f9f6352e57a55027bc4c9e8334e0c5ac7dcc7a",
    "event_fingerprint": "ac011f350f9fe0954b7cc61e0b45df391f389c7e",
    "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 318,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 43,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c320302e1081b893477bbe441fe69221",
        "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
    },
    "target_context": {
        "dst_port": 8989,
        "service": "http",
        "service_name": "http",
        "risk_score": 43
    },
    "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "method": "GET",
    "path": "\/",
    "query_string": "pc_probe=9fcc4fea20118932-bet4bx",
    "waf_tags": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bx HTTP\/1.1",
    "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "query_string": "pc_probe=9fcc4fea20118932-bet4bx",
        "waf_tags": [
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bx HTTP\/1.1",
        "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a91c793f8895b81c790b4bb2a0f505e2d58b13bd",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bx HTTP\/1.1",
        "port": 8989,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "attack_vector": "port scan syn \u00b7 via HTTP:8989 \u00b7 (reconnaissance)",
    "target_port_label": "8989 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (40 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 44,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 43,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 43,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8989,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bx HTTP\/1.1",
            "port": 8989,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8989 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4bx HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "target_port_label": "8989 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8989"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 110,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 110,
    "scan_velocity_ports_per_s": 99.65,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 40,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "http_absolute_uri",
        "http_no_ua",
        "net_port_scan_fast"
    ]
}

{
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 4152,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 8,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "23de072e9a1494fc55bbabd489aa96cdf4221467",
    "event_fingerprint": "4087a49aeaf0bb155adde23aa6aa25e77512e191",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f6d7f72f6464e12cbf41f58650886486",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 4152,
        "risk_score": 42
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2033368fbd67c8f9dd6238d06bbc536b9fbe7ca5",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "port": 4152
    },
    "evidence_snippet": "\ufffd\"\r\ufffdN",
    "attack_vector": "port scan syn \u00b7 port 4152 \u00b7 (reconnaissance)",
    "target_port_label": "4152",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (40 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 8,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4152,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
            "port": 4152
        },
        "attack_vector": "port scan syn \u00b7 port 4152 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\"\r\ufffdN",
        "target_port_label": "4152",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4152"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 110,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 110,
    "scan_velocity_ports_per_s": 99.45,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 40,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "socks4_greeting"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 1,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
    "http_target_hash": "2962994dbf5e6bb8b9a72dcd53680db430057aab",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 194,
    "payload_entropy": 5.025411202261986,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 9081,
    "risk_waf": 44,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 43,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "f10937a89c7927386d0da3f5d63f0014fa87320a",
    "event_fingerprint": "7cbd0351c1d67db36f367c0a61bb8cea3f8611d7",
    "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 43,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "630bd286cc5776cd812d563049c9a27f",
        "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
    },
    "target_context": {
        "dst_port": 9081,
        "service": "http",
        "service_name": "http",
        "risk_score": 43
    },
    "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4da HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "method": "GET",
    "path": "\/",
    "query_string": "pc_probe=9fcc4fea20118932-bet4da",
    "waf_tags": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4da HTTP\/1.1",
    "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4da HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4da HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "query_string": "pc_probe=9fcc4fea20118932-bet4da",
        "waf_tags": [
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4da HTTP\/1.1",
        "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4da HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4da HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "81e24473f46f334f60da9b906816976dbb58f9a5",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4da HTTP\/1.1",
        "port": 9081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4da HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "attack_vector": "port scan syn \u00b7 via HTTP:9081 \u00b7 (reconnaissance)",
    "target_port_label": "9081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (40 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 44,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 43,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 43,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9081,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4da HTTP\/1.1",
            "port": 9081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:9081 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4da HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "target_port_label": "9081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 111,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 111,
    "scan_velocity_ports_per_s": 99.68,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 40,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "http_absolute_uri",
        "http_no_ua",
        "net_flood"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 1,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
    "http_target_hash": "888a29eab1acf26aed032e018bcb5efde653c0bc",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 194,
    "payload_entropy": 5.048758238411371,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8140,
    "risk_waf": 44,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "86f87998bdacf4beedda5f8a99a393b394923c2e",
    "event_fingerprint": "1a0a5cf3e6445c752e9b6369fd66e4791327b408",
    "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "51c4ad42aa4356043607b968373205ba",
        "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
    },
    "target_context": {
        "dst_port": 8140,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "method": "GET",
    "path": "\/",
    "query_string": "pc_probe=9fcc4fea20118932-bet4d5",
    "waf_tags": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d5 HTTP\/1.1",
    "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "query_string": "pc_probe=9fcc4fea20118932-bet4d5",
        "waf_tags": [
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d5 HTTP\/1.1",
        "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2a033a75023547567f160d6a9855883acdb2c5a0",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d5 HTTP\/1.1",
        "port": 8140,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "attack_vector": "port scan syn \u00b7 via HTTP:8140 \u00b7 (reconnaissance)",
    "target_port_label": "8140 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (40 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 44,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8140,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d5 HTTP\/1.1",
            "port": 8140,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8140 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4d5 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "target_port_label": "8140 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8140"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 111,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 111,
    "scan_velocity_ports_per_s": 99.01,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 40,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "http_absolute_uri",
        "http_no_ua",
        "net_flood"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
    "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 98,
    "payload_entropy": 4.732491723718083,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8070,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "1e21aa2a327c3a52c1b6b35be76be4932e56c061",
    "event_fingerprint": "1cc214854e32dd4ccc827fa2864ba51aca07c490",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
        "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
    },
    "target_context": {
        "dst_port": 8070,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
    "method": "CONNECT",
    "path": "check.proxypool.sh:443",
    "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
    "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
    "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
    "evidence": {
        "method": "CONNECT",
        "path": "check.proxypool.sh:443",
        "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
        "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
        "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ce11b882345931a19494dfc841de2788d7fc8418",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "check.proxypool.sh:443",
        "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
        "port": 8070,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
    "attack_vector": "port scan syn \u00b7 via HTTP:8070 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
    "target_port_label": "8070 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (40 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8070,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "check.proxypool.sh:443",
            "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
            "port": 8070,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8070 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
        "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
        "target_port_label": "8070 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8070"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 111,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 111,
    "scan_velocity_ports_per_s": 98.56,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 40,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_flood"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 10808,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 8,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "c8722aef09accd36f0528c25680ba865e7cc8341",
    "event_fingerprint": "7c76cb32245c7afdc4a433a242cce3906bea3a00",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0567"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SOCKS5 greeting"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0567"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 10808,
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ae0fb129e3e9e7fd1d660e018c8d8d1ad35f33c8",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 10808
    },
    "attack_vector": "port scan syn \u00b7 port 10808 \u00b7 (reconnaissance)",
    "target_port_label": "10808",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 8,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 10808,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 10808
        },
        "attack_vector": "port scan syn \u00b7 port 10808 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "10808",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "10808"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 112,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 112,
    "scan_velocity_ports_per_s": 99.27,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "socks5_greeting"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 1,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
    "http_target_hash": "bd3d032eaf604868603af922e1d94e6eb9bf6e56",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 194,
    "payload_entropy": 5.028654452174824,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8008,
    "risk_waf": 44,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "bf3aaf78cdbfed7c4d1e8adcdb524a5d4962a2ae",
    "event_fingerprint": "db35d70c6a73b9fa6b94fbccfaf3851ad7bcc1ef",
    "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b90363fd736b043c02c1914e2d99228c",
        "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
    },
    "target_context": {
        "dst_port": 8008,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dl HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "method": "GET",
    "path": "\/",
    "query_string": "pc_probe=9fcc4fea20118932-bet4dl",
    "waf_tags": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dl HTTP\/1.1",
    "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dl HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dl HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "query_string": "pc_probe=9fcc4fea20118932-bet4dl",
        "waf_tags": [
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dl HTTP\/1.1",
        "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dl HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dl HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "220c48e03d24082a3442d69976712e4e715ac504",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dl HTTP\/1.1",
        "port": 8008,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dl HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "attack_vector": "port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance)",
    "target_port_label": "8008 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 44,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8008,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dl HTTP\/1.1",
            "port": 8008,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4dl HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "target_port_label": "8008 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8008"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 113,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 113,
    "scan_velocity_ports_per_s": 99.52,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "http_absolute_uri",
        "http_no_ua",
        "net_flood"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
    "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 98,
    "payload_entropy": 4.732491723718083,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8060,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "766c17ae064a5c1c65ff4d2717d5a48bcf2578e9",
    "event_fingerprint": "bbc81270401d8cc194b4446a3c04627ba4dfed54",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
        "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
    },
    "target_context": {
        "dst_port": 8060,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
    "method": "CONNECT",
    "path": "check.proxypool.sh:443",
    "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
    "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
    "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
    "evidence": {
        "method": "CONNECT",
        "path": "check.proxypool.sh:443",
        "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
        "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
        "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a700078512f2800571f21aeeb004d17d8a641522",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "check.proxypool.sh:443",
        "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
        "port": 8060,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
    "attack_vector": "port scan syn \u00b7 via HTTP:8060 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
    "target_port_label": "8060 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8060,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "check.proxypool.sh:443",
            "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
            "port": 8060,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8060 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
        "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
        "target_port_label": "8060 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8060"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 113,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 113,
    "scan_velocity_ports_per_s": 98.93,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_flood"
    ]
}

{
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 1094,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 8,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "1bd0dbe1982b674ee318b1bb585437470915d751",
    "event_fingerprint": "6a420932d1a1452a0c5eadc18c273f35f2d8593d",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f6d7f72f6464e12cbf41f58650886486",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 1094,
        "risk_score": 42
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0f639a6ac2e4ba5e9dd4c4b39dd7dfce5776f1c0",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "port": 1094
    },
    "evidence_snippet": "\ufffd\"\r\ufffdN",
    "attack_vector": "port scan syn \u00b7 port 1094 \u00b7 (reconnaissance)",
    "target_port_label": "1094",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 8,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 1094,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
            "port": 1094
        },
        "attack_vector": "port scan syn \u00b7 port 1094 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\"\r\ufffdN",
        "target_port_label": "1094",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "1094"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 113,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 113,
    "scan_velocity_ports_per_s": 98.75,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "socks4_greeting"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
    "http_target_hash": "653284d8832cb649ca5d43d81285c062f5d41966",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 98,
    "payload_entropy": 4.732491723718083,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8090,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "a19221beee9376dd5c97121ae44eabac52886e28",
    "event_fingerprint": "fe66004aae1d89811438c248937f14ee87b14c25",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "977c4171ca9dd67fbcf427f725fbcf25",
        "path_pattern_hash": "576596a4341716fe49da3e1d21ec2ba5"
    },
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
    "method": "CONNECT",
    "path": "check.proxypool.sh:443",
    "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
    "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
    "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
    "evidence": {
        "method": "CONNECT",
        "path": "check.proxypool.sh:443",
        "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
        "request_sample": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close\r\n\r\n",
        "payload_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b8ccf0e958a904fd94d17699ac1a2b0b81e77c26",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "check.proxypool.sh:443",
        "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
    "attack_vector": "port scan syn \u00b7 via HTTP:8090 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "check.proxypool.sh:443",
            "request_line": "CONNECT check.proxypool.sh:443 HTTP\/1.1",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8090 \u00b7 (reconnaissance) \u00b7 \u2192 check.proxypool.sh:443",
        "evidence_snippet": "CONNECT check.proxypool.sh:443 HTTP\/1.1\r\nHost: check.proxypool.sh:443\r\nProxy-Connection: close",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 113,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 113,
    "scan_velocity_ports_per_s": 98.31,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_flood"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 4145,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 8,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "4f3cec40d30214c4cfed0b536a0017ae764df2aa",
    "event_fingerprint": "e68a0475b0c0801d3e3c5c4d94267af1f81792e4",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0567"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SOCKS5 greeting"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0567"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 4145,
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "91d94a3a6ef5aadc5d7fcacc604b6485d5acfd0a",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 4145
    },
    "attack_vector": "port scan syn \u00b7 port 4145 \u00b7 (reconnaissance)",
    "target_port_label": "4145",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 8,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4145,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 4145
        },
        "attack_vector": "port scan syn \u00b7 port 4145 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "4145",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4145"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 113,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 113,
    "scan_velocity_ports_per_s": 98.13,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "socks5_greeting"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 7070,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 8,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "7aeb0d29923a656c3ad1e274f2c50362dd36057a",
    "event_fingerprint": "5028d63b539a65496b39029800c445dbc79473d9",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0567"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SOCKS5 greeting"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0567"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 7070,
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c68361790f58f33a52f5439d00cfedb23b7e23f5",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 7070
    },
    "attack_vector": "port scan syn \u00b7 port 7070 \u00b7 (reconnaissance)",
    "target_port_label": "7070",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 8,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7070,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 7070
        },
        "attack_vector": "port scan syn \u00b7 port 7070 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "7070",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7070"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 113,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 113,
    "scan_velocity_ports_per_s": 97.96,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "socks5_greeting"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 1,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
    "http_target_hash": "78af68a851b6a238da4edbb49d154d89d8c69f6e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 194,
    "payload_entropy": 5.005837263015137,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8899,
    "risk_waf": 44,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "73409c092c52376901a51e05f4a2d7d8ebe0371f",
    "event_fingerprint": "7ff57198855af0b6cfd2170dc07e1d8929c3d7f9",
    "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ccb4e26b9b360a31f33cf0c7d6c45f3d",
        "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
    },
    "target_context": {
        "dst_port": 8899,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "method": "GET",
    "path": "\/",
    "query_string": "pc_probe=9fcc4fea20118932-bet4c9",
    "waf_tags": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c9 HTTP\/1.1",
    "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "query_string": "pc_probe=9fcc4fea20118932-bet4c9",
        "waf_tags": [
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c9 HTTP\/1.1",
        "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5efabcff30040f438f5872c80a0dfde6919537e8",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c9 HTTP\/1.1",
        "port": 8899,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "attack_vector": "port scan syn \u00b7 via HTTP:8899 \u00b7 (reconnaissance)",
    "target_port_label": "8899 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 44,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c9 HTTP\/1.1",
            "port": 8899,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8899 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4c9 HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "target_port_label": "8899 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 114,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 114,
    "scan_velocity_ports_per_s": 98.19,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "http_absolute_uri",
        "http_no_ua",
        "net_flood"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 5,
    "http_query_params": 1,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
    "http_target_hash": "ca487fec12e900d54268484e6b12631f31df88b4",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 194,
    "payload_entropy": 5.020037714057217,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8004,
    "risk_waf": 44,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 42,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "e8b883eb7bb94944c7007a54195901adb7a5bd24",
    "event_fingerprint": "ebf85054435cc0a46db27521de5e60dc94588b16",
    "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1867b1c859a8d80fd3389af99cdca7d1",
        "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
    },
    "target_context": {
        "dst_port": 8004,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "method": "GET",
    "path": "\/",
    "query_string": "pc_probe=9fcc4fea20118932-bet4cz",
    "waf_tags": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cz HTTP\/1.1",
    "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "query_string": "pc_probe=9fcc4fea20118932-bet4cz",
        "waf_tags": [
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cz HTTP\/1.1",
        "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0b24af35905dd7d53c8170ef454edb0102bef2cb",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cz HTTP\/1.1",
        "port": 8004,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "attack_vector": "port scan syn \u00b7 via HTTP:8004 \u00b7 (reconnaissance)",
    "target_port_label": "8004 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 44,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8004,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cz HTTP\/1.1",
            "port": 8004,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8004 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cz HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "target_port_label": "8004 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8004"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 115,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 115,
    "scan_velocity_ports_per_s": 98.41,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "http_absolute_uri",
        "http_no_ua",
        "net_flood"
    ]
}

{
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 1089,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 8,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "2c8735bac46dea25715692a44fcc5a3832cfe86c",
    "event_fingerprint": "3710c0d3bdc496be4a40d41e058e73ed79d5307d",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f6d7f72f6464e12cbf41f58650886486",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 1089,
        "risk_score": 42
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5a2c50c65f17d63dfb50f286b258be657ffe40f0",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "port": 1089
    },
    "evidence_snippet": "\ufffd\"\r\ufffdN",
    "attack_vector": "port scan syn \u00b7 port 1089 \u00b7 (reconnaissance)",
    "target_port_label": "1089",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 8,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 1089,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
            "port": 1089
        },
        "attack_vector": "port scan syn \u00b7 port 1089 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\"\r\ufffdN",
        "target_port_label": "1089",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "1089"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 115,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 115,
    "scan_velocity_ports_per_s": 98.22,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "socks4_greeting"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420746f725f736f636b7320726561647920706f72743d393035300d0a",
    "emulator_response_len": 40,
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "tor-socks",
    "app_proto": "tor-socks",
    "asn": 197170,
    "country": "NL",
    "dst_port": 9050,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "2c831387782d6f36f1058587ab565bec5f901708",
    "event_fingerprint": "8d1c76f2f050f83c15bec50eede8ee530021190f",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0567"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SOCKS5 greeting"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0567"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "tor-socks",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9050,
        "service": "tor-socks",
        "service_name": "tor-socks",
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "936f317e51747ecf70d737af26b177fd55e3e845",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 9050,
        "service": "tor-socks",
        "service_label_fr": "TOR SOCKS"
    },
    "attack_vector": "port scan syn \u00b7 via TOR SOCKS:9050 \u00b7 (reconnaissance)",
    "target_port_label": "9050 \u00b7 TOR SOCKS",
    "emulator_service": "tor-socks",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via TOR SOCKS \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "tor-socks",
        "service_label_fr": "TOR SOCKS",
        "dst_port": 9050,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tor-socks",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 9050,
            "service": "tor-socks",
            "service_label_fr": "TOR SOCKS"
        },
        "attack_vector": "port scan syn \u00b7 via TOR SOCKS:9050 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "9050 \u00b7 TOR SOCKS",
        "emulator_service": "tor-socks",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tor_socks",
        "service_banner": "honeypot-tor-socks",
        "service_os": "linux",
        "dst_port": "9050"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 115,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 115,
    "scan_velocity_ports_per_s": 98.07,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "socks5_greeting"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 1090,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 8,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "f0e373d87cadb2981b361fcb95616de7a8fc1a48",
    "event_fingerprint": "8a1f60e7549b300db76b0dee0c5e7fe484a841ec",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0567"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SOCKS5 greeting"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0567"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 8,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 1090,
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "75bfaebccbc91432fb522ed7ebe7a4627469337f",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 1090
    },
    "attack_vector": "port scan syn \u00b7 port 1090 \u00b7 (reconnaissance)",
    "target_port_label": "1090",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 8,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 1090,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 1090
        },
        "attack_vector": "port scan syn \u00b7 port 1090 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "1090",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "1090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 115,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 115,
    "scan_velocity_ports_per_s": 97.91,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_flood",
        "socks5_greeting"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "4e001550726f746f636f6c00044a524d4900004b000000020000",
    "emulator_response_len": 26,
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "java-rmi",
    "app_proto": "java-rmi",
    "asn": 197170,
    "country": "NL",
    "dst_port": 1099,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "124beec97ae98cbfd39790ddfadb3275959c2f74",
    "event_fingerprint": "ba47546e33af8181599bd1c5811966eb6f3ab196",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "java-rmi",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f6d7f72f6464e12cbf41f58650886486",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 1099,
        "service": "java-rmi",
        "service_name": "java-rmi",
        "risk_score": 42
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8f546bd9dda3591e548642a7a1aaa90d0172c08c",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
        "port": 1099,
        "service": "java-rmi",
        "service_label_fr": "JAVA RMI"
    },
    "evidence_snippet": "\ufffd\"\r\ufffdN",
    "attack_vector": "port scan syn \u00b7 via JAVA RMI:1099 \u00b7 (reconnaissance)",
    "target_port_label": "1099 \u00b7 JAVA RMI",
    "emulator_service": "java-rmi",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via JAVA RMI \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "java-rmi",
        "service_label_fr": "JAVA RMI",
        "dst_port": 1099,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-java-rmi",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\"\r\ufffdN\u0000",
            "port": 1099,
            "service": "java-rmi",
            "service_label_fr": "JAVA RMI"
        },
        "attack_vector": "port scan syn \u00b7 via JAVA RMI:1099 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\"\r\ufffdN",
        "target_port_label": "1099 \u00b7 JAVA RMI",
        "emulator_service": "java-rmi",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +23",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "java_rmi",
        "service_banner": "honeypot-java-rmi",
        "service_os": "linux",
        "dst_port": "1099"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 115,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 115,
    "scan_velocity_ports_per_s": 97.74,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "java_rmi_emulated",
        "net_flood",
        "socks4_greeting"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 1,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "e351c6aeec250af79252674212a1ceb980d10195",
    "http_target_hash": "f6c1608c0a1d6c2621daa1d586d02bdd0b5d2ead",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 194,
    "payload_entropy": 5.020037714057217,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": "http",
    "app_proto": "http",
    "asn": 197170,
    "country": "NL",
    "dst_port": 8119,
    "risk_waf": 44,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 43,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "1dd14a35b74f2315feedf2cee883091c3865749a",
    "event_fingerprint": "19784426096011cae158021cd811202f23a7be30",
    "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 44,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 43,
        "correlation_boost": 23
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "336c1aed64749dc3072161c17b6baf77",
        "path_pattern_hash": "218e29d2d3b820c33bdc17b1341fc469"
    },
    "target_context": {
        "dst_port": 8119,
        "service": "http",
        "service_name": "http",
        "risk_score": 43
    },
    "payload_preview": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "method": "GET",
    "path": "\/",
    "query_string": "pc_probe=9fcc4fea20118932-bet4cw",
    "waf_tags": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cw HTTP\/1.1",
    "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "query_string": "pc_probe=9fcc4fea20118932-bet4cw",
        "waf_tags": [
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cw HTTP\/1.1",
        "request_sample": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "23a1b5e5b03cfef3149141710ed648e7b5280c42",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cw HTTP\/1.1",
        "port": 8119,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
    "attack_vector": "port scan syn \u00b7 via HTTP:8119 \u00b7 (reconnaissance)",
    "target_port_label": "8119 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "classification_reason_label_fr": "Tags WAF: nosqli-3, sap-sapcontrol-path \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (41 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 44,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 43,
            "correlation_boost": 23
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 43,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8119,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +23",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cw HTTP\/1.1",
            "port": 8119,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:8119 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET http:\/\/check.proxypool.sh\/?pc_probe=9fcc4fea20118932-bet4cw HTTP\/1.1\r\nHost: check.proxypool.sh\r\nAccept: application\/json,*\/*",
        "target_port_label": "8119 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 44 \u00b7 Bonus corr\u00e9lation +23 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8119"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 116,
    "port_scan_ports_sample": [
        81,
        82,
        83,
        84,
        88,
        999,
        1080,
        1081,
        1082,
        1085,
        1086,
        1087,
        1088,
        1089,
        1090,
        1091
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 116,
    "scan_velocity_ports_per_s": 97.98,
    "multi_category_scan": true,
    "scan_category_diversity": [
        "blockchain",
        "cloud",
        "web"
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 41,
    "multi_protocol_sample": [
        "bitcoin",
        "consul",
        "discord-webhook",
        "hdfs-namenode",
        "http",
        "https",
        "java-rmi",
        "kafka-jmx"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_category_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 23,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "http_absolute_uri",
        "http_no_ua",
        "net_flood"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 4153,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "468f125ac3a52406bb24d0652d79396d01719582",
    "event_fingerprint": "41794b88e734e886ed08a00414954ac84077d62b",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 4153,
        "risk_score": 35
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fee74f1808338641838b871de2c8202e7c678c9e",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 4153
    },
    "attack_vector": "proxy probe \u00b7 port 4153 \u00b7 (sonde \/ probe)",
    "target_port_label": "4153",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4153,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 4153
        },
        "attack_vector": "proxy probe \u00b7 port 4153 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "4153",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4153"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks5_greeting"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 1089,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "4b1b6cb382b1113e469b9f01af15a920afd2ee57",
    "event_fingerprint": "7153360ea0fd0251b13f08287f012f08c0201cef",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 1089,
        "risk_score": 35
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ce5955168c6ce64d8eae0041b628933fd9e6df37",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 1089
    },
    "attack_vector": "proxy probe \u00b7 port 1089 \u00b7 (sonde \/ probe)",
    "target_port_label": "1089",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 1089,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 1089
        },
        "attack_vector": "proxy probe \u00b7 port 1089 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1089",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "1089"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:1089",
        "port:4153"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks5_greeting"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 1091,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "d2fca03cd43201ffcd2abfaeb1466431edfc8028",
    "event_fingerprint": "fed6f2c30c22638b11ff0585ec66ff08feec7fed",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0567"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SOCKS5 greeting"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0567"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 12
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 1091,
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "25de7a3a0abeb10688008755c33bd7aa7660f365",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 1091
    },
    "attack_vector": "port scan syn \u00b7 port 1091 \u00b7 (reconnaissance)",
    "target_port_label": "1091",
    "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 12
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 1091,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +12",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 1091
        },
        "attack_vector": "port scan syn \u00b7 port 1091 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "1091",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +12",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "1091"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 7.03,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:1089",
        "port:1091",
        "port:4153"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 12,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks5_greeting"
    ]
}

{
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "registered",
    "org": "TechTies Inc.",
    "service": null,
    "app_proto": null,
    "asn": 197170,
    "country": "NL",
    "dst_port": 9052,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "ef6a49b847f98f357884c4d9de5d9ea1827bc3a8",
    "event_fingerprint": "1d76ea154835c6f690b505738b221e9196499038",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0554",
        "pat-0567"
    ],
    "matched_pattern_names": [
        "Minecraft varint handshake",
        "SOCKS5 greeting"
    ],
    "pattern_ids": [
        "pat-0554",
        "pat-0567"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 197170,
        "org": "TechTies Inc.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 9052,
        "risk_score": 42
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e288839cc0a9e83a26f136e5daf4e2a2c3f56b15",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 9052
    },
    "attack_vector": "port scan syn \u00b7 port 9052 \u00b7 (reconnaissance)",
    "target_port_label": "9052",
    "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9052,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 9052
        },
        "attack_vector": "port scan syn \u00b7 port 9052 \u00b7 (reconnaissance)",
        "evidence_snippet": null,
        "target_port_label": "9052",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9052"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        1089,
        1091,
        4153,
        9052
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 9.34,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:1089",
        "port:1091",
        "port:4153",
        "port:9052"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks5_greeting"
    ]
}