45.205.1.244

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 1111,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.9,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 38,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "ea297c22c9b3f1f14cc6f6ddb3fc6aa88d165ae1",
    "event_fingerprint": "a2620a823d751bad85b7b2ead0c891288e81bc46",
    "classification_reason": "Type \u00ab port_1111_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.65,
    "classification_confidence": 0.65,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30,
        "risk_score": 38,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 1111,
        "service": "http",
        "service_name": "http",
        "risk_score": 38
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab port_1111_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1f371fef750cd67fb6865cd34b79c3f662ca2440",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.68.0",
        "port": 1111,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "attack_vector": "port 1111 tcp \u00b7 via HTTP:1111 \u00b7 (sonde \/ probe)",
    "target_port_label": "1111 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_1111_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_1111_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
        "confidence_pct": 65,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 30,
            "risk_score": 38,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1111,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.68.0",
            "port": 1111,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 1111 tcp \u00b7 via HTTP:1111 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "target_port_label": "1111 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 32 \u00b7 Bonus corr\u00e9lation +10 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (45.205.1.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1111"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "45.205.1.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 8081,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 38,
    "tag_count": 6,
    "anomaly_count": 1,
    "campaign_key": "be4657ce52d3c7c246c62c1791104ff2773199e6",
    "event_fingerprint": "232c358527f57073b8ce3ac2952e07107acffec0",
    "classification_reason": "Type \u00ab port_8081_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30,
        "risk_score": 38
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 38
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab port_8081_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4a98e1d8b413887775d3caffaeea3ac0a23678c3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.68.0",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "attack_vector": "port 8081 tcp \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe)",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_8081_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_8081_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 30,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.68.0",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 8081 tcp \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "net_web_probe",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 8899,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 38,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "7ebdcbbac76e056f78f6e438c0be13aaecc1801c",
    "event_fingerprint": "793795ecabb0e7b3bd3556d3c5479dad3f8b107e",
    "classification_reason": "Type \u00ab port_8899_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30,
        "risk_score": 38
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8899,
        "service": "http",
        "service_name": "http",
        "risk_score": 38
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab port_8899_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "019e7128e36d280e74ce411e9f581c40551e9f71",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.68.0",
        "port": 8899,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "attack_vector": "port 8899 tcp \u00b7 via HTTP:8899 \u00b7 (sonde \/ probe)",
    "target_port_label": "8899 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_8899_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_8899_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 30,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8899,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.68.0",
            "port": 8899,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 8899 tcp \u00b7 via HTTP:8899 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "target_port_label": "8899 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8899"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 8090,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 6.9,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 38,
    "tag_count": 6,
    "anomaly_count": 1,
    "campaign_key": "8260f75b8d725411979b253a9fd305d6c8984f54",
    "event_fingerprint": "9028a01c41411dd97fdbb8cc9621b5ff48076aae",
    "classification_reason": "Type \u00ab port_8090_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30,
        "risk_score": 38
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 38
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab port_8090_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f6466fb11360891324d7d52b0b0014bca849b623",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.68.0",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "attack_vector": "port 8090 tcp \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe)",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_8090_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_8090_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 30,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.68.0",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 8090 tcp \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "net_web_probe",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c",
    "emulator_response_len": 158,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 5000,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 38,
    "tag_count": 6,
    "anomaly_count": 1,
    "campaign_key": "2c9e6de3d0ef08c3b213ac439c060c62edec0f6a",
    "event_fingerprint": "2bc1c2cda4344dbe8adb234d705fd0cba69a3120",
    "classification_reason": "Type \u00ab port_5000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30,
        "risk_score": 38
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 5000,
        "service": "http",
        "service_name": "http",
        "risk_score": 38
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab port_5000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1e400f78bb2caac2d3661d1b9cc9bf648c1668f5",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.68.0",
        "port": 5000,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "attack_vector": "port 5000 tcp \u00b7 via HTTP:5000 \u00b7 (sonde \/ probe)",
    "target_port_label": "5000 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_5000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_5000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 30,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5000,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.68.0",
            "port": 5000,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 5000 tcp \u00b7 via HTTP:5000 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "target_port_label": "5000 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "net_web_probe",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "6e82000c0a104142434445464748494a",
    "emulator_response_len": 16,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "well_known",
    "org": "Vpsvault.host Ltd",
    "service": "kerberos",
    "app_proto": "kerberos",
    "asn": 215925,
    "country": "US",
    "dst_port": 88,
    "risk_waf": 8,
    "risk_classification": 16,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 32,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 16,
        "behavior": 0,
        "geo": 0,
        "protocol": 32,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "8e9cb969ceab740c93efec9e791ca73d858fd046",
    "event_fingerprint": "31e4a798ccff9624b861a6d5c96061ad06a8a14c",
    "classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 16,
        "behavior": 0,
        "geo": 0,
        "protocol": 32,
        "novelty": 15,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "kerberos",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "d6f845779b5f0a377f3854eb15f1b5b6"
    },
    "target_context": {
        "dst_port": 88,
        "service": "kerberos",
        "service_name": "kerberos",
        "risk_score": 24
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7c727866aecc7234e2975d9009b209aa393f0f34",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "port": 88,
        "service": "kerberos",
        "service_label_fr": "KERBEROS"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
    "target_port_label": "88 \u00b7 KERBEROS",
    "emulator_service": "kerberos",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab kerberos \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 16,
            "behavior": 0,
            "geo": 0,
            "protocol": 32,
            "novelty": 15,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "kerberos",
        "service_label_fr": "KERBEROS",
        "dst_port": 88,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-kerberos",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
            "port": 88,
            "service": "kerberos",
            "service_label_fr": "KERBEROS"
        },
        "attack_vector": "kerberos \u00b7 via KERBEROS:88 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "target_port_label": "88 \u00b7 KERBEROS",
        "emulator_service": "kerberos",
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "kerberos",
        "service_banner": "honeypot-kerberos",
        "service_os": "linux",
        "dst_port": "88"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 81,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 8080,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 40,
    "tag_count": 6,
    "anomaly_count": 1,
    "campaign_key": "6b72789ba559a30d0f30c2aa10343244d74f282e",
    "event_fingerprint": "122f6b472dc92a9979a36b83bcc8218f9cb29583",
    "classification_reason": "Type \u00ab port_8080_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30,
        "risk_score": 40
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8080,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab port_8080_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d1d6bb1f268f30f688653bc01ef8be37a15921fe",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.68.0",
        "port": 8080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "attack_vector": "port 8080 tcp \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
    "target_port_label": "8080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_8080_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_8080_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 30,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.68.0",
            "port": 8080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 8080 tcp \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "target_port_label": "8080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "net_web_probe",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 8083,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 38,
    "tag_count": 6,
    "anomaly_count": 1,
    "campaign_key": "865f10df46a58aa51f18e87a7e20752382edd35c",
    "event_fingerprint": "5ae896afc025344dead8f70651f37e38c582ab4f",
    "classification_reason": "Type \u00ab port_8083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30,
        "risk_score": 38
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8083,
        "service": "http",
        "service_name": "http",
        "risk_score": 38
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab port_8083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f05565b4918615825d9b2375a25d342150d2f4e3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.68.0",
        "port": 8083,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "attack_vector": "port 8083 tcp \u00b7 via HTTP:8083 \u00b7 (sonde \/ probe)",
    "target_port_label": "8083 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_8083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_8083_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 38\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 30,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8083,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.68.0",
            "port": 8083,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 8083 tcp \u00b7 via HTTP:8083 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "target_port_label": "8083 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 32 \u00b7 2 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8083"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "net_web_probe",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 1487,
    "payload_entropy": 7.729027493525274,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "https",
    "app_proto": "https",
    "asn": 215925,
    "country": "US",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
    "event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "96ecfba9e4462ea071658319be3e968a",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "https",
        "service_name": "https",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\"\ufffdq^\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rx\ufffd_B\ufffdS3iX\ufffd)|\ufffd\ufffd\u0016\u05f2 \ufffd\ufffd1\ufffdFsc\ufffd\ufffd\ufffd\u0002V`\u0791\ufffd-;\ufffd\ufffdY\u0012v\ufffd\ufffd-|\rg\ufffd3\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\"\ufffdq^\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rx\ufffd_B\ufffdS3iX\ufffd)|\ufffd\ufffd\u0016\u05f2 \ufffd\ufffd1\ufffdFsc\ufffd\ufffd\ufffd\u0002V`\u0791\ufffd-;\ufffd\ufffdY\u0012v\ufffd\ufffd-|\rg\ufffd3\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\u0007U[ni3\ufffd`Kp\ufffd\u0014\ufffdq\ufffd]t\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\"\ufffdq^\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rx\ufffd_B\ufffdS3iX\ufffd)|\ufffd\ufffd\u0016\u05f2 \ufffd\ufffd1\ufffdFsc\ufffd\ufffd\ufffd\u0002V`\u0791\ufffd-;\ufffd\ufffdY\u0012v\ufffd\ufffd-|\rg\ufffd3\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9d3e5b34ff4c6f235e7de08b3d60a0525a21e067",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\"\ufffdq^\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rx\ufffd_B\ufffdS3iX\ufffd)|\ufffd\ufffd\u0016\u05f2 \ufffd\ufffd1\ufffdFsc\ufffd\ufffd\ufffd\u0002V`\u0791\ufffd-;\ufffd\ufffdY\u0012v\ufffd\ufffd-|\rg\ufffd3\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
        "port": 8443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "\ufffd\ufffd\"\ufffdq^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rx\ufffd_B\ufffdS3iX\ufffd)|\ufffd\ufffd\u05f2 \ufffd\ufffd1\ufffdFsc\ufffd\ufffd\ufffdV`\u0791\ufffd-;\ufffd\ufffdYv\ufffd\ufffd-|\rg\ufffd3\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
    "attack_vector": "postgres probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
    "target_port_label": "8443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 35\/100 (Faible) \u2014 MITRE TA0007 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 8443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\"\ufffdq^\ufffd\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rx\ufffd_B\ufffdS3iX\ufffd)|\ufffd\ufffd\u0016\u05f2 \ufffd\ufffd1\ufffdFsc\ufffd\ufffd\ufffd\u0002V`\u0791\ufffd-;\ufffd\ufffdY\u0012v\ufffd\ufffd-|\rg\ufffd3\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
            "port": 8443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "postgres probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\"\ufffdq^\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\rx\ufffd_B\ufffdS3iX\ufffd)|\ufffd\ufffd\u05f2 \ufffd\ufffd1\ufffdFsc\ufffd\ufffd\ufffdV`\u0791\ufffd-;\ufffd\ufffdYv\ufffd\ufffd-|\rg\ufffd3\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
        "target_port_label": "8443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8"
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "8443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 8081,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 38,
    "tag_count": 6,
    "anomaly_count": 1,
    "campaign_key": "be4657ce52d3c7c246c62c1791104ff2773199e6",
    "event_fingerprint": "232c358527f57073b8ce3ac2952e07107acffec0",
    "classification_reason": "Type \u00ab port_8081_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30,
        "risk_score": 38
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http",
        "service_name": "http",
        "risk_score": 38
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab port_8081_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4a98e1d8b413887775d3caffaeea3ac0a23678c3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "curl\/7.68.0",
        "port": 8081,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "attack_vector": "port 8081 tcp \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe)",
    "target_port_label": "8081 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_8081_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_8081_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 30,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8081,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "curl\/7.68.0",
            "port": 8081,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 8081 tcp \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "target_port_label": "8081 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF"
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8081"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "net_web_probe",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 1111,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.9,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 38,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "ea297c22c9b3f1f14cc6f6ddb3fc6aa88d165ae1",
    "event_fingerprint": "a2620a823d751bad85b7b2ead0c891288e81bc46",
    "classification_reason": "Type \u00ab port_1111_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30,
        "risk_score": 38
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 1111,
        "service": "http",
        "service_name": "http",
        "risk_score": 38
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab port_1111_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1f371fef750cd67fb6865cd34b79c3f662ca2440",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "port": 1111,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "attack_vector": "port 1111 tcp \u00b7 via HTTP:1111 \u00b7 (sonde \/ probe)",
    "target_port_label": "1111 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_1111_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_1111_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 30,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1111,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "port": 1111,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port 1111 tcp \u00b7 via HTTP:1111 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "target_port_label": "1111 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes \u00b7 2 tag(s) WAF"
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1111"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
    "emulator_response_len": 141,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "sap-icm",
    "app_proto": "sap-icm",
    "asn": 215925,
    "country": "US",
    "dst_port": 8000,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 48,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 48,
        "novelty": 15
    },
    "risk_score": 34,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "5dd8b425ee22c6c2bdbfb7ac7e7032daa914f354",
    "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
    "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 48,
        "novelty": 15,
        "risk_score": 34
    },
    "named_classification_skipped": false,
    "service_name": "sap-icm",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc"
    },
    "target_context": {
        "dst_port": 8000,
        "service": "sap-icm",
        "service_name": "sap-icm",
        "risk_score": 34
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bf38f3f5ee1135c0e18cfda336cd76669075723a",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 54,
            "behavior": 0,
            "geo": 0,
            "protocol": 48,
            "novelty": 15,
            "risk_score": 34
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 34,
        "risk_label": "Faible",
        "service_name": "sap-icm",
        "service_label_fr": "SAP ICM",
        "dst_port": 8000,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-icm",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_icm",
        "service_banner": "honeypot-sap-icm",
        "service_os": "linux",
        "dst_port": "8000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "net_sap_web_probe",
        "sap_icm_emulated",
        "sap_icm_payload"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "well_known",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 81,
    "risk_waf": 32,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 38,
    "tag_count": 6,
    "anomaly_count": 1,
    "campaign_key": "390e632f9c71147cf0806bc5a5704e8ff4323e7d",
    "event_fingerprint": "93b99149c88203d13851e75b2e5467efcd0111cb",
    "classification_reason": "Type \u00ab port_81_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 32,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30,
        "risk_score": 38
    },
    "named_classification_skipped": true,
    "named_candidate": "web_scanner",
    "service_name": "http",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 38
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab port_81_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "67ba24782406fc84a3caefad199c00b5d1f1e1de",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_81_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_81_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 32,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 30,
            "risk_score": 38
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 38,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "net_web_probe",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 8888,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 42,
    "tag_count": 6,
    "anomaly_count": 1,
    "campaign_key": "e0db4986cd303a2bdf1668e4cfb3f7289d4e64d7",
    "event_fingerprint": "02d83459edfce64ea9c4204521900a0d5452ec35",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0599"
    ],
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30,
        "risk_score": 42
    },
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8888,
        "service": "http",
        "service_name": "http",
        "risk_score": 42
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3674159bd90f0f04bf9f56ff051f27b6f08c8ac3",
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8888"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "probe",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "net_web_probe",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 8181,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 18,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "f0b43653fcbd76eee02bf3d5a7df293964891864",
    "event_fingerprint": "7dc05c84705bb631a906361f6f851bd772b4c42a",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8181,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6b3212e37af26cdad9b642f5a330a9bf7267cd8e",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f742067616d655f756e7265616c20726561647920706f72743d373737370d0a",
    "emulator_response_len": 42,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "game-unreal",
    "app_proto": "game-unreal",
    "asn": 215925,
    "country": "US",
    "dst_port": 7777,
    "risk_waf": 8,
    "risk_classification": 16,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 32,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 16,
        "behavior": 0,
        "geo": 0,
        "protocol": 32,
        "novelty": 15
    },
    "risk_score": 2,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "3e7ec7f3991985c9eedf55a9c367a039789da62e",
    "event_fingerprint": "a35789f75452d6a73be983d5f266e3a77d710b7e",
    "classification_reason": "Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "10384eda5161b41f764c9b11f5a8ba8f"
    },
    "target_context": {
        "dst_port": 7777,
        "service": "game-unreal"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab game-unreal \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "573eb95ef8f84cc7da981b47951c693b05a7e3e6",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 8800,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 6.1,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 17,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "3f12b58264a4a8f3046396d6378a65e61f6df2f4",
    "event_fingerprint": "e6640c6d3870992e0b8e6aebbdfbb668a25fb3ee",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8800,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "71f4f31e4aee017a33b27707ada31a72347a0bf2",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "US",
    "dst_port": 8801,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 18,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "12a59529462aaef8b9a32b31441476aba2edd604",
    "event_fingerprint": "ed58fc0ca64b05d9728517d553a89cfb9855518b",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8801,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6c50d674c7bfefff30c39d0f7744e16e8d53c1bf",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 81,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8080,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 17,
    "tag_count": 6,
    "anomaly_count": 1,
    "campaign_key": "6b72789ba559a30d0f30c2aa10343244d74f282e",
    "event_fingerprint": "122f6b472dc92a9979a36b83bcc8218f9cb29583",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8080,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ecbc349c0cf9289003a72d47927283831f00dfac",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "net_web_probe",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
    "emulator_response_len": 141,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "sap-icm",
    "app_proto": "sap-icm",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8000,
    "risk_waf": 8,
    "risk_classification": 54,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 48,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 54,
        "behavior": 0,
        "geo": 0,
        "protocol": 48,
        "novelty": 15
    },
    "risk_score": 8,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "5dd8b425ee22c6c2bdbfb7ac7e7032daa914f354",
    "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
    "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "2dea5f3383fd8694e14eaf8b920fd9fc"
    },
    "target_context": {
        "dst_port": 8000,
        "service": "sap-icm"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "Type \u00ab sap_web_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bf38f3f5ee1135c0e18cfda336cd76669075723a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "net_sap_web_probe",
        "sap_icm_emulated",
        "sap_icm_payload"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8081,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 16,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "2d9c80e944c07b9cba1f72a339b05c14ab8199a8",
    "event_fingerprint": "232c358527f57073b8ce3ac2952e07107acffec0",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8081,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "803224c64a3758a5d24e4132e5575cd1cb31329d",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8085,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 17,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "c8c522684f23bf95ca5263812b8c85508430fc12",
    "event_fingerprint": "b83aea09999e0a97772ac80be9abdd6aac8e5919",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8085,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c1a85f3cfcbd3cba72e6bd7be0f15b826b78b4c8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 1487,
    "payload_entropy": 7.759442989863943,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "https",
    "app_proto": "https",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8443,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 15,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "841a7de3c3cbd932ffe2df923d0bb6a948309046",
    "event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b35157442d4e97d1da573fdafb358065",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 8443,
        "service": "https"
    },
    "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\u0019\ufffd{\"\ufffd\ufffd\u0019+\ufffdD]\ufffd#`\ufffdvO\u0084lI\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffdMh )p\ufffd\ufffd!\ufffd\ufffd\u000f\u0017F\u0015\u000e\ufffd\ufffdy\ufffd6>\u0017(\ufffd\ufffd\ufffd\t\u0002\ufffd$\uf70f\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
    "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\u0019\ufffd{\"\ufffd\ufffd\u0019+\ufffdD]\ufffd#`\ufffdvO\u0084lI\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffdMh )p\ufffd\ufffd!\ufffd\ufffd\u000f\u0017F\u0015\u000e\ufffd\ufffdy\ufffd6>\u0017(\ufffd\ufffd\ufffd\t\u0002\ufffd$\uf70f\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd]\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffdti\tA\ufffd\u06df\ufffd\u001b\ufffdp\ufffdw",
    "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\u0019\ufffd{\"\ufffd\ufffd\u0019+\ufffdD]\ufffd#`\ufffdvO\u0084lI\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffdMh )p\ufffd\ufffd!\ufffd\ufffd\u000f\u0017F\u0015\u000e\ufffd\ufffdy\ufffd6>\u0017(\ufffd\ufffd\ufffd\t\u0002\ufffd$\uf70f\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\u0019\ufffd{\"\ufffd\ufffd\u0019+\ufffdD]\ufffd#`\ufffdvO\u0084lI\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffdMh )p\ufffd\ufffd!\ufffd\ufffd\u000f\u0017F\u0015\u000e\ufffd\ufffdy\ufffd6>\u0017(\ufffd\ufffd\ufffd\t\u0002\ufffd$\uf70f\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011\ufffd\u0011\ufffd\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd]\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffdti\tA\ufffd\u06df\ufffd\u001b\ufffdp\ufffdw",
        "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003E\u0019\ufffd{\"\ufffd\ufffd\u0019+\ufffdD]\ufffd#`\ufffdvO\u0084lI\ufffd\ufffd[b\ufffd\ufffd\ufffd\ufffdMh )p\ufffd\ufffd!\ufffd\ufffd\u000f\u0017F\u0015\u000e\ufffd\ufffdy\ufffd6>\u0017(\ufffd\ufffd\ufffd\t\u0002\ufffd$\uf70f\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "348fe56d6cad8f280acfa9d21b786f78206603f8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "tls_clienthello"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "well_known",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 81,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 16,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "8e66c7dcfef475b3eba3e75bc1c8db47cdd1e617",
    "event_fingerprint": "93b99149c88203d13851e75b2e5467efcd0111cb",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "768be7662a7ce8ab0d1f4390995207a32fc4935c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "well_known",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 88,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.9,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 17,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "d2f487269863129f5601f31b6531c7479907873c",
    "event_fingerprint": "fa17b6f9ffc0a884fcc54ad25019036664306546",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 88,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2e5e0e10deced5bf3b31460e8fd2914ddbbf5774",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8888,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 28,
    "tag_count": 6,
    "anomaly_count": 1,
    "campaign_key": "e0db4986cd303a2bdf1668e4cfb3f7289d4e64d7",
    "event_fingerprint": "02d83459edfce64ea9c4204521900a0d5452ec35",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0599"
    ],
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8888,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 50%"
    },
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 50%",
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3674159bd90f0f04bf9f56ff051f27b6f08c8ac3",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "net_web_probe",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8801,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 18,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "12a59529462aaef8b9a32b31441476aba2edd604",
    "event_fingerprint": "ed58fc0ca64b05d9728517d553a89cfb9855518b",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8801,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6c50d674c7bfefff30c39d0f7744e16e8d53c1bf",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8800,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 6.1,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 17,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "3f12b58264a4a8f3046396d6378a65e61f6df2f4",
    "event_fingerprint": "e6640c6d3870992e0b8e6aebbdfbb668a25fb3ee",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8800,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "71f4f31e4aee017a33b27707ada31a72347a0bf2",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8090,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 6.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 18,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "1fe79bddf5efd8e13b28b2996b9f2dc8205069db",
    "event_fingerprint": "9028a01c41411dd97fdbb8cc9621b5ff48076aae",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8090,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2a3e348bff56c4802db6373126a7f31abc5453af",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 1111,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.9,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 17,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "ea297c22c9b3f1f14cc6f6ddb3fc6aa88d165ae1",
    "event_fingerprint": "a2620a823d751bad85b7b2ead0c891288e81bc46",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 1111,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a2d977e0474dca3b4a737eaa62bec0116fc0030b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c",
    "emulator_response_len": 158,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 5000,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 30
    },
    "risk_score": 15,
    "tag_count": 6,
    "anomaly_count": 1,
    "campaign_key": "2c9e6de3d0ef08c3b213ac439c060c62edec0f6a",
    "event_fingerprint": "2bc1c2cda4344dbe8adb234d705fd0cba69a3120",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 5000,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e5739bfbd50fc03753aa5960ee7c009157165e64",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "net_web_probe",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 7777,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 6.1,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 17,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "441be4cd2cb7f3c12f8123c3dd6c8571a1a794f5",
    "event_fingerprint": "b3f46ed63fafdbe6dc14f602d6cf510f6d00d0e8",
    "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 7777,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d9e8ad4962b09790aa767254c8498817f0fe38b8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8083,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 22,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "654c4bd7853bec7c56d2079f64958f898634165f",
    "event_fingerprint": "5ae896afc025344dead8f70651f37e38c582ab4f",
    "classification_reason": "R\u00e8gle WAF \u00ab sap-sapcontrol-path \u00bb",
    "confidence": 0.21,
    "classification_confidence": 0.21,
    "precision_score": 25,
    "precision_signals": [
        "Classification amont"
    ],
    "risk_confidence_factor": 21,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8083,
        "service": "http"
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "user_agent": "curl\/7.68.0",
    "waf_tags": [
        "950734:sap-sapcontrol-path",
        "scanner-ua"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path",
        "scanner-ua"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "curl\/7.68.0",
        "waf_tags": [
            "950734:sap-sapcontrol-path",
            "scanner-ua"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path",
            "scanner-ua"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close",
        "classification_reason": "R\u00e8gle WAF \u00ab sap-sapcontrol-path \u00bb"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dd367b534537e0bdb433662a7fb8419a855d085f",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8899,
    "risk_waf": 32,
    "risk_classification": 42,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 32,
        "classification": 42,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 24,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "7ebdcbbac76e056f78f6e438c0be13aaecc1801c",
    "event_fingerprint": "793795ecabb0e7b3bd3556d3c5479dad3f8b107e",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8899,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "disclosed_scanner"
    ],
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "event_signature": "b4b34cfe477fd739ce3cbae942ee0983cf10d38b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 7777,
    "risk_waf": 32,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 6.1,
    "risk_breakdown": {
        "waf": 32,
        "classification": 30,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 26,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "f384589288b8ee2829ce55cf5a4ad877285e676a",
    "event_fingerprint": "3f3bba27c5f5df8bb9692f302bad7af2e5d64b9f",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 7777,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "event_signature": "9f6ec4a516e72d1b86e8cdbf6c4f3142d55ca886",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8000,
    "risk_waf": 32,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 32,
        "classification": 30,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 22,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "88fe4a7ad5165173f5e462cf689d3b4d88b5d36c",
    "event_fingerprint": "e1c0c85ec32def59777043a6640e6195bd4e1e00",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8000,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "event_signature": "75c90088cf62ad35c23a8743aaefdbad7afe492d",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "well_known",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 88,
    "risk_waf": 32,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5.9,
    "risk_breakdown": {
        "waf": 32,
        "classification": 30,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 25,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "10a7d7bbe423b34eb7d0b9d0327941611f097de9",
    "event_fingerprint": "aee707815b899e8cc03c185fa526535386cf2bd0",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 88,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "event_signature": "ede4ed244c866745f7c98fec0e72a36c46aeeb1f",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8801,
    "risk_waf": 32,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 32,
        "classification": 30,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 26,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "bb8fbf0f436b909039eb7814ff8598bc019ef08c",
    "event_fingerprint": "d3109d0598983dd95c3a4c5c9dc4abef915b5a14",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8801,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "event_signature": "d53c870963a4e03e476d6ce86b8716d547d55511",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8899,
    "risk_waf": 32,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 32,
        "classification": 30,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 22,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "43eae3e327b9a6ab05cf71d69536886dc2d05768",
    "event_fingerprint": "d48c3d8b946d2c985bb68d9ed3546c10dcac1b16",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8899,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "event_signature": "7c85c805558ac4a3e35325c07d57566de4c21fc4",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 8080,
    "risk_waf": 32,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 32,
        "classification": 30,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 24,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "de8c40439a6148cda65c84a02ccf9959cb156646",
    "event_fingerprint": "e8d7e440ce64622852a586f753bfe5d0110d3e76",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8080,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "event_signature": "96b5ab0ad3215ea1b26efe3a6e6611376f83eb19",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "dst_port": 5000,
    "risk_waf": 32,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 32,
        "classification": 30,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 23,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "c770872b4a3e1d09a2e3c56a1c6b374720e4c6ef",
    "event_fingerprint": "75a3a9e560bcdbdbc1d9fd15750e1b81cebffe01",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 5000,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "event_signature": "f4d71f8b74bc130e5621017cb52b6109c2b20007",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "bc1bc2956e51c5b9c9f7c213c207ff9a36c04117",
    "http_host_hash": null,
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": true,
    "http_ua_is_browser": false,
    "bytes_in": 62,
    "payload_entropy": 4.732027963438207,
    "port_category": "registered",
    "org": "Vpsvault.host Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 215925,
    "country": "SC",
    "risk_waf": 30,
    "risk_classification": 30,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 30,
    "risk_boost": 0,
    "risk_breakdown": {
        "waf": 30,
        "classification": 30,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 30
    },
    "risk_score": 18,
    "tag_count": 5,
    "anomaly_count": 1,
    "campaign_key": "c09b9366ba15c9d97d11682c7354007b0b394a4d",
    "event_fingerprint": "463cc4a8c724f8d63a697629fd1468d142a07c01",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "SC",
        "asn": 215925,
        "org": "Vpsvault.host Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c2d945f9e2ebe73a50cc502e17a53fdc",
        "payload_hash": "ac7f8a04638b9d43b6172e3bf0e60155",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 1111,
        "service": "http"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.8,
    "classification_confidence": 0.8,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.68.0\r\nConnection: close\r\n\r\n",
    "event_signature": "f9f0177dae7f6af6bca2bbf55dc66f78c95eded2",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "anomaly:scanner-ua",
        "http_missing_host",
        "http_ua_suspicious",
        "scanner-ua"
    ]
}