45.194.67.50

{
    "protocol_emulated": true,
    "bytes_in": 409,
    "payload_entropy": 5.427277850102987,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f37527517ccc9c745ed3da30e1891978",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_57e4c08158f765b7 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "request_sample": "GET \/check_57e4c08158f765b7 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
    "payload_snippet": "GET \/check_57e4c08158f765b7 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "evidence": {
        "request_sample": "GET \/check_57e4c08158f765b7 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
        "payload_snippet": "GET \/check_57e4c08158f765b7 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8a940cbdb225f2d1b4e41c659070a736cfb368fb",
    "protocol_details": {
        "payload_preview": "GET \/check_57e4c08158f765b7 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_57e4c08158f765b7 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_57e4c08158f765b7 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_57e4c08158f765b7 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 410,
    "payload_entropy": 5.426354104034209,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a25caa00364ee21e3dc40001589b1dbe",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_5cfe1fa904d8dbde HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "request_sample": "GET \/check_5cfe1fa904d8dbde HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
    "payload_snippet": "GET \/check_5cfe1fa904d8dbde HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "evidence": {
        "request_sample": "GET \/check_5cfe1fa904d8dbde HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
        "payload_snippet": "GET \/check_5cfe1fa904d8dbde HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "922c1a5cabe58dc79abcfc8c501a23501bcaf007",
    "protocol_details": {
        "payload_preview": "GET \/check_5cfe1fa904d8dbde HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_5cfe1fa904d8dbde HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_5cfe1fa904d8dbde HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_5cfe1fa904d8dbde HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 425,
    "payload_entropy": 5.419217223136964,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eb576f347ca34648d5c906189f1b6b62",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_0d078257be36991b HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
    "request_sample": "GET \/check_0d078257be36991b HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/",
    "payload_snippet": "GET \/check_0d078257be36991b HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
    "evidence": {
        "request_sample": "GET \/check_0d078257be36991b HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/",
        "payload_snippet": "GET \/check_0d078257be36991b HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9c7125a68a3a8b2cd009deae0b6f528bdf7f7ce0",
    "protocol_details": {
        "payload_preview": "GET \/check_0d078257be36991b HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_0d078257be36991b HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_0d078257be36991b HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_0d078257be36991b HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 410,
    "payload_entropy": 5.447629436484174,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e3df870f89eb766ea3bf3c9006045949",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_87420f7abd88feed HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "request_sample": "GET \/check_87420f7abd88feed HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
    "payload_snippet": "GET \/check_87420f7abd88feed HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "evidence": {
        "request_sample": "GET \/check_87420f7abd88feed HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
        "payload_snippet": "GET \/check_87420f7abd88feed HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "67ce513a0e50ba9cfd496def207a423bb5530db2",
    "protocol_details": {
        "payload_preview": "GET \/check_87420f7abd88feed HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_87420f7abd88feed HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_87420f7abd88feed HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_87420f7abd88feed HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 93,
    "payload_entropy": 4.937699703908597,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "36b5246d569e179832b765c65582d1f2",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: 51.195.40.238:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: 51.195.40.238:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: 51.195.40.238:443\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: 51.195.40.238:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: 51.195.40.238:443\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "31407cef2ee49ed81ebbeff4a468c06c1510e0f7",
    "protocol_details": {
        "payload_preview": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: 51.195.40.238:443\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: 51.195.40.238:443\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: 51.195.40.238:443\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 51.195.40.238:443 HTTP\/1.1\r\nHost: 51.195.40.238:443\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "656f2ade018285154084843e184aaa89",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
    "request_sample": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
    "payload_snippet": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
        "payload_snippet": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "560627375792857d4bce200e9a4fb4fbc34a8b81",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "P\ufffdC\ufffdc",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0000P\ufffdC\ufffdc\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "P\ufffdC\ufffdc",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 91,
    "payload_entropy": 4.8325696734528245,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5567cac6ed1c1622149a8008f88cefba",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: 51.222.140.50:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: 51.222.140.50:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: 51.222.140.50:80\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: 51.222.140.50:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: 51.222.140.50:80\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "051f4b8cc2c48b04ad6f3856aec9dc94389b1c82",
    "protocol_details": {
        "payload_preview": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: 51.222.140.50:80\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: 51.222.140.50:80\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: 51.222.140.50:80\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 51.222.140.50:80 HTTP\/1.1\r\nHost: 51.222.140.50:80\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.1,
    "classification_confidence": 0.1,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fa7aa61033535afa526dd888eb4db7dc",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 34
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0dc89c1c81003537abba78ad789d4fa8af9a70ba",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "\ufffd3\u078c2",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 10,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd3\u078c2\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd3\u078c2",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 93,
    "payload_entropy": 4.937699703908597,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bab4513dbaecae635312e23a9ea1b62c",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 172.67.140.99:443 HTTP\/1.1\r\nHost: 172.67.140.99:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT 172.67.140.99:443 HTTP\/1.1\r\nHost: 172.67.140.99:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT 172.67.140.99:443 HTTP\/1.1\r\nHost: 172.67.140.99:443\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT 172.67.140.99:443 HTTP\/1.1\r\nHost: 172.67.140.99:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT 172.67.140.99:443 HTTP\/1.1\r\nHost: 172.67.140.99:443\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8cbc41d3650991c23268a4492e0bcd4072facdc1",
    "protocol_details": {
        "payload_preview": "CONNECT 172.67.140.99:443 HTTP\/1.1\r\nHost: 172.67.140.99:443\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT 172.67.140.99:443 HTTP\/1.1\r\nHost: 172.67.140.99:443\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT 172.67.140.99:443 HTTP\/1.1\r\nHost: 172.67.140.99:443\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 172.67.140.99:443 HTTP\/1.1\r\nHost: 172.67.140.99:443\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 43,
    "payload_entropy": 4.080350731889837,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "90dd4c667bc52feda2067d5e83f11659",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
    "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
    "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
        "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "446d92a0ce00e9489319725bbdced3a041b385e7",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "Pmake-internet-safer-for-the.world",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "Pmake-internet-safer-for-the.world",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 101,
    "payload_entropy": 4.827835032844681,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "28f725c7b60efd9cf897e65515a40279",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world:443\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world:443\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "60cecb3860f342a4dcd762aab182af4007e0ef28",
    "protocol_details": {
        "payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world:443\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world:443\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world:443\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT we-love-the.world:443 HTTP\/1.1\r\nHost: we-love-the.world:443\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 131,
    "payload_entropy": 4.861839056225379,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c828e5f68786daef1a45f3cb1a07251f",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT make-internet-safer-for-the.world:80 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world:80\r\nProxy-Connection: Keep-Alive\r",
    "request_sample": "CONNECT make-internet-safer-for-the.world:80 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT make-internet-safer-for-the.world:80 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world:80\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT make-internet-safer-for-the.world:80 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT make-internet-safer-for-the.world:80 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world:80\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7efcc25963db5de5d2375211de3ea651c3eec0e2",
    "protocol_details": {
        "payload_preview": "CONNECT make-internet-safer-for-the.world:80 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world:80\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT make-internet-safer-for-the.world:80 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world:80\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT make-internet-safer-for-the.world:80 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world:80\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT make-internet-safer-for-the.world:80 HTTP\/1.1\r\nHost: make-internet-safer-for-the.world:80\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 409,
    "payload_entropy": 5.409317720262628,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8f4d71f7faeb15bfa547ffecbaba6910",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_a596a581ba15af03 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "request_sample": "GET \/check_a596a581ba15af03 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
    "payload_snippet": "GET \/check_a596a581ba15af03 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "evidence": {
        "request_sample": "GET \/check_a596a581ba15af03 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
        "payload_snippet": "GET \/check_a596a581ba15af03 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e32bd64edc282fa0ade35c66e986ba89526abc2b",
    "protocol_details": {
        "payload_preview": "GET \/check_a596a581ba15af03 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_a596a581ba15af03 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_a596a581ba15af03 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_a596a581ba15af03 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 425,
    "payload_entropy": 5.397820031333473,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a5ac829bbbfb873b150d32863245be93",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_eef11b80526ff3a3 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
    "request_sample": "GET \/check_eef11b80526ff3a3 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/",
    "payload_snippet": "GET \/check_eef11b80526ff3a3 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
    "evidence": {
        "request_sample": "GET \/check_eef11b80526ff3a3 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/",
        "payload_snippet": "GET \/check_eef11b80526ff3a3 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "66a6582bf873bbf38a5d4d75ad3fbbe3facc2d3e",
    "protocol_details": {
        "payload_preview": "GET \/check_eef11b80526ff3a3 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_eef11b80526ff3a3 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_eef11b80526ff3a3 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_eef11b80526ff3a3 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 410,
    "payload_entropy": 5.401904220547367,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "cc5068434c43dabeaff02a5f869573af",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_b4ace1ebaaf7a5b7 HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "request_sample": "GET \/check_b4ace1ebaaf7a5b7 HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
    "payload_snippet": "GET \/check_b4ace1ebaaf7a5b7 HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "evidence": {
        "request_sample": "GET \/check_b4ace1ebaaf7a5b7 HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
        "payload_snippet": "GET \/check_b4ace1ebaaf7a5b7 HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c84c19f2618b80eafa3eb58c114c865c241e44e6",
    "protocol_details": {
        "payload_preview": "GET \/check_b4ace1ebaaf7a5b7 HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_b4ace1ebaaf7a5b7 HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_b4ace1ebaaf7a5b7 HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_b4ace1ebaaf7a5b7 HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 410,
    "payload_entropy": 5.4468989521239335,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "69e2dbebea557298c69aa99e954d23a2",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_a75d5438d2a56dde HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "request_sample": "GET \/check_a75d5438d2a56dde HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
    "payload_snippet": "GET \/check_a75d5438d2a56dde HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "evidence": {
        "request_sample": "GET \/check_a75d5438d2a56dde HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
        "payload_snippet": "GET \/check_a75d5438d2a56dde HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7e3653df5e2aa772953464505bb02bd9604a4103",
    "protocol_details": {
        "payload_preview": "GET \/check_a75d5438d2a56dde HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_a75d5438d2a56dde HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_a75d5438d2a56dde HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_a75d5438d2a56dde HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 43,
    "payload_entropy": 4.106984383697434,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0929dd7a0458596a38b6ecbc72b88641",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c8d3d8b278675217a03016f96bd3986f9bd2e182",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "\ufffdmake-internet-safer-for-the.world",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0000\u0000\u0000\u0001\u0000make-internet-safer-for-the.world\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdmake-internet-safer-for-the.world",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 95,
    "payload_entropy": 4.954845903433889,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c0cc6ed0a99e3ce5cb2d1c9585539679",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 51.195.40.238:7000 HTTP\/1.1\r\nHost: 51.195.40.238:7000\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT 51.195.40.238:7000 HTTP\/1.1\r\nHost: 51.195.40.238:7000\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT 51.195.40.238:7000 HTTP\/1.1\r\nHost: 51.195.40.238:7000\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT 51.195.40.238:7000 HTTP\/1.1\r\nHost: 51.195.40.238:7000\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT 51.195.40.238:7000 HTTP\/1.1\r\nHost: 51.195.40.238:7000\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "91440c0fd12bc50a247a66026304dc3004886215",
    "protocol_details": {
        "payload_preview": "CONNECT 51.195.40.238:7000 HTTP\/1.1\r\nHost: 51.195.40.238:7000\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT 51.195.40.238:7000 HTTP\/1.1\r\nHost: 51.195.40.238:7000\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT 51.195.40.238:7000 HTTP\/1.1\r\nHost: 51.195.40.238:7000\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 51.195.40.238:7000 HTTP\/1.1\r\nHost: 51.195.40.238:7000\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 409,
    "payload_entropy": 5.434931850453307,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f0175c1eaf8d284c709201d3702141a3",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_72d43944bf330da4 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "request_sample": "GET \/check_72d43944bf330da4 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
    "payload_snippet": "GET \/check_72d43944bf330da4 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "evidence": {
        "request_sample": "GET \/check_72d43944bf330da4 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
        "payload_snippet": "GET \/check_72d43944bf330da4 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "85bdb6c879229de9b6b37f65a3a0134711d5bedc",
    "protocol_details": {
        "payload_preview": "GET \/check_72d43944bf330da4 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_72d43944bf330da4 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_72d43944bf330da4 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_72d43944bf330da4 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 410,
    "payload_entropy": 5.452486986110601,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7a061e6524f9f044b4658d64c6dd4354",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_485a50f58d21f29a HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "request_sample": "GET \/check_485a50f58d21f29a HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
    "payload_snippet": "GET \/check_485a50f58d21f29a HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "evidence": {
        "request_sample": "GET \/check_485a50f58d21f29a HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
        "payload_snippet": "GET \/check_485a50f58d21f29a HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ea6b07cbbc11f870d918c2b3536a4b16a8cd5394",
    "protocol_details": {
        "payload_preview": "GET \/check_485a50f58d21f29a HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_485a50f58d21f29a HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_485a50f58d21f29a HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_485a50f58d21f29a HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 410,
    "payload_entropy": 5.461233528491238,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "004c3054d912be0017444b149084a55d",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_87f86d796ad81126 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "request_sample": "GET \/check_87f86d796ad81126 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
    "payload_snippet": "GET \/check_87f86d796ad81126 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "evidence": {
        "request_sample": "GET \/check_87f86d796ad81126 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
        "payload_snippet": "GET \/check_87f86d796ad81126 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "862bfc10e2bf03e6f7b5ac19a1f6036e126fb7cd",
    "protocol_details": {
        "payload_preview": "GET \/check_87f86d796ad81126 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_87f86d796ad81126 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_87f86d796ad81126 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_87f86d796ad81126 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 409,
    "payload_entropy": 5.386213473468849,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "67d717c1be2b6504ea4d8f2623c4b976",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_e1a05ba08faece66 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "request_sample": "GET \/check_e1a05ba08faece66 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
    "payload_snippet": "GET \/check_e1a05ba08faece66 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "evidence": {
        "request_sample": "GET \/check_e1a05ba08faece66 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
        "payload_snippet": "GET \/check_e1a05ba08faece66 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "da0ddeb4ef42f5637447a294c0db9ae43c209741",
    "protocol_details": {
        "payload_preview": "GET \/check_e1a05ba08faece66 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_e1a05ba08faece66 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_e1a05ba08faece66 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_e1a05ba08faece66 HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 93,
    "payload_entropy": 4.83544405870078,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4da1a47669bd843fb28aa1f5605950ac",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: 51.222.140.50:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: 51.222.140.50:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: 51.222.140.50:443\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: 51.222.140.50:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: 51.222.140.50:443\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "64059e5b50723887c088234139331f76eaa55904",
    "protocol_details": {
        "payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: 51.222.140.50:443\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: 51.222.140.50:443\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: 51.222.140.50:443\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: 51.222.140.50:443\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2df390166234c2aac824138f8b2e501c",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0004\u0001\u0000P3\u078c2\u0000",
    "request_sample": "\u0004\u0001\u0000P3\u078c2\u0000",
    "payload_snippet": "\u0004\u0001\u0000P3\u078c2\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0000P3\u078c2\u0000",
        "payload_snippet": "\u0004\u0001\u0000P3\u078c2\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3371e8c379216c831c2e7b5f50ee78f36920ca03",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0000P3\u078c2\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "P3\u078c2",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0000P3\u078c2\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "P3\u078c2",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "503edac9d6129a84cc854f57188a2944",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0004\u0001\u0000Ph\u0015(\ufffd\u0000",
    "request_sample": "\u0004\u0001\u0000Ph\u0015(\ufffd\u0000",
    "payload_snippet": "\u0004\u0001\u0000Ph\u0015(\ufffd\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0000Ph\u0015(\ufffd\u0000",
        "payload_snippet": "\u0004\u0001\u0000Ph\u0015(\ufffd\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "07622e0d9598038a52e10e53419891faf3bc1508",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0000Ph\u0015(\ufffd\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "Ph(\ufffd",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0000Ph\u0015(\ufffd\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "Ph(\ufffd",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 9,
    "payload_entropy": 3.169925001442312,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.1,
    "classification_confidence": 0.1,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3d150b6f7e5a0baa0c1303e3f6090b1a",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 34
    },
    "payload_preview": "\u0004\u0001\u001bX3\u078c2\u0000",
    "request_sample": "\u0004\u0001\u001bX3\u078c2\u0000",
    "payload_snippet": "\u0004\u0001\u001bX3\u078c2\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u001bX3\u078c2\u0000",
        "payload_snippet": "\u0004\u0001\u001bX3\u078c2\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e784fbe2d6a3835ebb9a82b652f277edc9595e7a",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u001bX3\u078c2\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "X3\u078c2",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 10,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u001bX3\u078c2\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "X3\u078c2",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 91,
    "payload_entropy": 4.953663629591879,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c8140db6249707da4e6890158b6413f8",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: 51.195.40.238:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: 51.195.40.238:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: 51.195.40.238:80\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: 51.195.40.238:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: 51.195.40.238:80\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3fe502b2ee2f40191594ce14bfd03c99b96e8aed",
    "protocol_details": {
        "payload_preview": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: 51.195.40.238:80\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: 51.195.40.238:80\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: 51.195.40.238:80\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 51.195.40.238:80 HTTP\/1.1\r\nHost: 51.195.40.238:80\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 93,
    "payload_entropy": 4.706411800636263,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "98a85db40cb3f5149c9e1dca3f6950b9",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 104.21.40.244:443 HTTP\/1.1\r\nHost: 104.21.40.244:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT 104.21.40.244:443 HTTP\/1.1\r\nHost: 104.21.40.244:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT 104.21.40.244:443 HTTP\/1.1\r\nHost: 104.21.40.244:443\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT 104.21.40.244:443 HTTP\/1.1\r\nHost: 104.21.40.244:443\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT 104.21.40.244:443 HTTP\/1.1\r\nHost: 104.21.40.244:443\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b51636ab3148976b2707a06752e1e66b2edc8d76",
    "protocol_details": {
        "payload_preview": "CONNECT 104.21.40.244:443 HTTP\/1.1\r\nHost: 104.21.40.244:443\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT 104.21.40.244:443 HTTP\/1.1\r\nHost: 104.21.40.244:443\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT 104.21.40.244:443 HTTP\/1.1\r\nHost: 104.21.40.244:443\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 104.21.40.244:443 HTTP\/1.1\r\nHost: 104.21.40.244:443\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.1,
    "classification_confidence": 0.1,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "deab96328757c57430c3da1064ee2174",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 34
    },
    "payload_preview": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2b68b7b0b4fcdefd18a1de6a9fca01ccf71fe94d",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "\ufffdh(\ufffd",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 10,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffdh\u0015(\ufffd\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffdh(\ufffd",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.1,
    "classification_confidence": 0.1,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ea9fdabe5c0655ede7326703b196bd27",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 34
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "aa9543447a931ab2dc79f0913f2846c67fac90d3",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "\ufffd3\ufffd(\ufffd",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 10,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd3\ufffd(\ufffd\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd3\ufffd(\ufffd",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 91,
    "payload_entropy": 4.953663629591878,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "01b58411789319eb21c15c7c3cd4c663",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 172.67.140.99:80 HTTP\/1.1\r\nHost: 172.67.140.99:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT 172.67.140.99:80 HTTP\/1.1\r\nHost: 172.67.140.99:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT 172.67.140.99:80 HTTP\/1.1\r\nHost: 172.67.140.99:80\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT 172.67.140.99:80 HTTP\/1.1\r\nHost: 172.67.140.99:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT 172.67.140.99:80 HTTP\/1.1\r\nHost: 172.67.140.99:80\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f31fe4b49fbcd048fd615c290b1e23b01567ad10",
    "protocol_details": {
        "payload_preview": "CONNECT 172.67.140.99:80 HTTP\/1.1\r\nHost: 172.67.140.99:80\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT 172.67.140.99:80 HTTP\/1.1\r\nHost: 172.67.140.99:80\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT 172.67.140.99:80 HTTP\/1.1\r\nHost: 172.67.140.99:80\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 172.67.140.99:80 HTTP\/1.1\r\nHost: 172.67.140.99:80\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 409,
    "payload_entropy": 5.403759402764329,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0ccbc0f1b7ec96e2c1b99baeab1def2a",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_0eb3af0c10fbb8ba HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "request_sample": "GET \/check_0eb3af0c10fbb8ba HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
    "payload_snippet": "GET \/check_0eb3af0c10fbb8ba HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "evidence": {
        "request_sample": "GET \/check_0eb3af0c10fbb8ba HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/",
        "payload_snippet": "GET \/check_0eb3af0c10fbb8ba HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "408f603949992221009887fba56e273561a6d09b",
    "protocol_details": {
        "payload_preview": "GET \/check_0eb3af0c10fbb8ba HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_0eb3af0c10fbb8ba HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_0eb3af0c10fbb8ba HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_0eb3af0c10fbb8ba HTTP\/1.1\r\nhost: we-love-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 95,
    "payload_entropy": 4.778750577610725,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a13f72043705077ac555d8315431102a",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 51.222.140.50:7000 HTTP\/1.1\r\nHost: 51.222.140.50:7000\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT 51.222.140.50:7000 HTTP\/1.1\r\nHost: 51.222.140.50:7000\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT 51.222.140.50:7000 HTTP\/1.1\r\nHost: 51.222.140.50:7000\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT 51.222.140.50:7000 HTTP\/1.1\r\nHost: 51.222.140.50:7000\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT 51.222.140.50:7000 HTTP\/1.1\r\nHost: 51.222.140.50:7000\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "18d80987ee46fc817f5faac26c9330123a5cc3fa",
    "protocol_details": {
        "payload_preview": "CONNECT 51.222.140.50:7000 HTTP\/1.1\r\nHost: 51.222.140.50:7000\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT 51.222.140.50:7000 HTTP\/1.1\r\nHost: 51.222.140.50:7000\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT 51.222.140.50:7000 HTTP\/1.1\r\nHost: 51.222.140.50:7000\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 51.222.140.50:7000 HTTP\/1.1\r\nHost: 51.222.140.50:7000\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 410,
    "payload_entropy": 5.451136282164401,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6970cb6cc98540276897199607c56f56",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_26ac729dbf25002d HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "request_sample": "GET \/check_26ac729dbf25002d HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
    "payload_snippet": "GET \/check_26ac729dbf25002d HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "evidence": {
        "request_sample": "GET \/check_26ac729dbf25002d HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
        "payload_snippet": "GET \/check_26ac729dbf25002d HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "44facb70583949402f1f370139263f490b390fdf",
    "protocol_details": {
        "payload_preview": "GET \/check_26ac729dbf25002d HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_26ac729dbf25002d HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_26ac729dbf25002d HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_26ac729dbf25002d HTTP\/1.1\r\nhost: tls.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 425,
    "payload_entropy": 5.407809235889773,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "51fdbc16667b2f69852508728a51a234",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_08ffceb34233fd08 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
    "request_sample": "GET \/check_08ffceb34233fd08 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/",
    "payload_snippet": "GET \/check_08ffceb34233fd08 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
    "evidence": {
        "request_sample": "GET \/check_08ffceb34233fd08 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/",
        "payload_snippet": "GET \/check_08ffceb34233fd08 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7bbdf9d61a2a870c006192f7695649461dc74c40",
    "protocol_details": {
        "payload_preview": "GET \/check_08ffceb34233fd08 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_08ffceb34233fd08 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_08ffceb34233fd08 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_08ffceb34233fd08 HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 410,
    "payload_entropy": 5.444305882342331,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7f9ffda13b0804a8122d62b777926c18",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_51b26b6c869aaf49 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "request_sample": "GET \/check_51b26b6c869aaf49 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
    "payload_snippet": "GET \/check_51b26b6c869aaf49 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "evidence": {
        "request_sample": "GET \/check_51b26b6c869aaf49 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image",
        "payload_snippet": "GET \/check_51b26b6c869aaf49 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8eba48061e45dc1f8cf58a704d576c1caefd6e87",
    "protocol_details": {
        "payload_preview": "GET \/check_51b26b6c869aaf49 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_51b26b6c869aaf49 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_51b26b6c869aaf49 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_51b26b6c869aaf49 HTTP\/1.1\r\nhost: raw.bunnyfeet.baby\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "56f33152f85e8df0a94aa2a6697b4aeb",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0004\u0001\u0000P3\ufffd(\ufffd\u0000",
    "request_sample": "\u0004\u0001\u0000P3\ufffd(\ufffd\u0000",
    "payload_snippet": "\u0004\u0001\u0000P3\ufffd(\ufffd\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0000P3\ufffd(\ufffd\u0000",
        "payload_snippet": "\u0004\u0001\u0000P3\ufffd(\ufffd\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "397ffa76ba0a711218f59f76c740a9e996e2cbfc",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0000P3\ufffd(\ufffd\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "P3\ufffd(\ufffd",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0000P3\ufffd(\ufffd\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "P3\ufffd(\ufffd",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 9,
    "payload_entropy": 3.169925001442312,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.1,
    "classification_confidence": 0.1,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "146a8426d8e4fdebf327d55fb684b6b5",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 34
    },
    "payload_preview": "\u0004\u0001\u001bX3\ufffd(\ufffd\u0000",
    "request_sample": "\u0004\u0001\u001bX3\ufffd(\ufffd\u0000",
    "payload_snippet": "\u0004\u0001\u001bX3\ufffd(\ufffd\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u001bX3\ufffd(\ufffd\u0000",
        "payload_snippet": "\u0004\u0001\u001bX3\ufffd(\ufffd\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3009d516791e78631fa8badab06ad004884fd7af",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u001bX3\ufffd(\ufffd\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "X3\ufffd(\ufffd",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 10,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u001bX3\ufffd(\ufffd\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "X3\ufffd(\ufffd",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 9,
    "payload_entropy": 2.94770277922009,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 34,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eeb646493d71d6f8d5cef82f140f8a6db3b63378",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.1,
    "classification_confidence": 0.1,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 34,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "df8005337761b32b101374e3ff5ece90",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 34
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6054d7b182669d0ab565897d18912c9fe97d22bf",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "\ufffd\ufffdC\ufffdc",
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
        "confidence_pct": 10,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 34,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\ufffdC\ufffdc\u0000",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdC\ufffdc",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 10 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks4_greeting",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 91,
    "payload_entropy": 4.761248519654219,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a9b5438c59e3c0fe98103592c829a477",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 104.21.40.244:80 HTTP\/1.1\r\nHost: 104.21.40.244:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT 104.21.40.244:80 HTTP\/1.1\r\nHost: 104.21.40.244:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT 104.21.40.244:80 HTTP\/1.1\r\nHost: 104.21.40.244:80\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT 104.21.40.244:80 HTTP\/1.1\r\nHost: 104.21.40.244:80\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT 104.21.40.244:80 HTTP\/1.1\r\nHost: 104.21.40.244:80\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8854b402bdb0ed7aec6555462dafb2d34cf59408",
    "protocol_details": {
        "payload_preview": "CONNECT 104.21.40.244:80 HTTP\/1.1\r\nHost: 104.21.40.244:80\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT 104.21.40.244:80 HTTP\/1.1\r\nHost: 104.21.40.244:80\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT 104.21.40.244:80 HTTP\/1.1\r\nHost: 104.21.40.244:80\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 104.21.40.244:80 HTTP\/1.1\r\nHost: 104.21.40.244:80\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 111,
    "payload_entropy": 4.840882624082943,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "07f7e2e20e6c76d559c43341602cf94694f86ff5",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "479e33fbd248488e5164e0596a17924e",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "CONNECT cdn.we-love-the.world:7000 HTTP\/1.1\r\nHost: cdn.we-love-the.world:7000\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "request_sample": "CONNECT cdn.we-love-the.world:7000 HTTP\/1.1\r\nHost: cdn.we-love-the.world:7000\r\nProxy-Connection: Keep-Alive\r\n\r\n",
    "payload_snippet": "CONNECT cdn.we-love-the.world:7000 HTTP\/1.1\r\nHost: cdn.we-love-the.world:7000\r\nProxy-Connection: Keep-Alive",
    "evidence": {
        "request_sample": "CONNECT cdn.we-love-the.world:7000 HTTP\/1.1\r\nHost: cdn.we-love-the.world:7000\r\nProxy-Connection: Keep-Alive\r\n\r\n",
        "payload_snippet": "CONNECT cdn.we-love-the.world:7000 HTTP\/1.1\r\nHost: cdn.we-love-the.world:7000\r\nProxy-Connection: Keep-Alive",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "71b633943fe9a4eade9b97d317c7bb90afaea591",
    "protocol_details": {
        "payload_preview": "CONNECT cdn.we-love-the.world:7000 HTTP\/1.1\r\nHost: cdn.we-love-the.world:7000\r\nProxy-Connection: Keep-Alive",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "CONNECT cdn.we-love-the.world:7000 HTTP\/1.1\r\nHost: cdn.we-love-the.world:7000\r\nProxy-Connection: Keep-Alive",
    "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "CONNECT cdn.we-love-the.world:7000 HTTP\/1.1\r\nHost: cdn.we-love-the.world:7000\r\nProxy-Connection: Keep-Alive",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "http flood \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT cdn.we-love-the.world:7000 HTTP\/1.1\r\nHost: cdn.we-love-the.world:7000\r\nProxy-Connection: Keep-Alive",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated"
    ]
}

{
    "protocol_emulated": true,
    "bytes_in": 425,
    "payload_entropy": 5.416207320539283,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 215925,
    "country": "US",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 20,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "892854ad827f8428eaa0a7a548d1a6e5292ab14e",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "socks5",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1805faa625b3b926c86bf660e2412883",
        "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 46
    },
    "payload_preview": "GET \/check_6a2490558cd53f7d HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; ",
    "request_sample": "GET \/check_6a2490558cd53f7d HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/",
    "payload_snippet": "GET \/check_6a2490558cd53f7d HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
    "evidence": {
        "request_sample": "GET \/check_6a2490558cd53f7d HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\r\naccept: text\/html,application\/xhtml+xml,application\/",
        "payload_snippet": "GET \/check_6a2490558cd53f7d HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "31835e799ea628b49305ee9cd3aee5fc07f21c6d",
    "protocol_details": {
        "payload_preview": "GET \/check_6a2490558cd53f7d HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "evidence_snippet": "GET \/check_6a2490558cd53f7d HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
    "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via SOCKS5 \u2014 campagne \/24 (45.194.67.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "GET \/check_6a2490558cd53f7d HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "xss attack \u00b7 via SOCKS5:1080 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/check_6a2490558cd53f7d HTTP\/1.1\r\nhost: make-internet-safer-for-the.world\r\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.194.67.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.194.67.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "mozi_pattern",
        "net_socks5_probe",
        "socks5_emulated"
    ]
}