{"ip":"45.92.17.75","exported_at":"2026-11-08T00:46:16+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":44,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["scanner"],"recommended_action":"monitor","confidence":0.5,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":49,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 44\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":50,"confidence_hint_fr":"Confiance mod\u00e9r\u00e9e \u2014 signal unique","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["Fp Port Probe Noise","Single Port"],"tags_summary":["INT-FP-port-probe-noise","INT-single-port"],"attack_vector":"Sonde port \u00b7 port 8808 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd\u003C\rR%\ufffd\ufffd\u0027_\u0002\u0000\u0022\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000","port":8808},"protocol_summary_fr":"Payload \u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r|Ufj\ufffd]\u0015(S\ufffd)f\ufffd\u003C\r\u2026","evidence_snippet":"\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\rR%\ufffd\ufffd\u0027_\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd","target_port_label":"8808","emulator_service":null,"confidence_reason":"Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique","classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab Sonde port \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 50 % \u2014 Score WAF 8","payload_preview":"\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\rR%\ufffd\ufffd\u0027_\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"75.17.92.45.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":11016025,"ip":"45.92.17.75","ts":"2026-10-31 04:15:30.000000","proto":"tcp","src_port":64044,"dst_port":8808,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 516, \u0022payload_entropy\u0022: 3.9791255536617784, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8808, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225cea88cb6e8d43a64cc9403cd7e98b6dc2d90439\u0022, \u0022event_fingerprint\u0022: \u002264af16d364af5a16e7f9d6e919a0471d67275a73\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a2a0ad11f9f8f1cf9217197b97b6f064\u0022, \u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8808, \u0022risk_score\u0022: 44}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000\\u0012\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0010sH\\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\\u0014\\u001d\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f1d9fe1da0855fec49f99481442a3ba72357ad34\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 8808}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 8808 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228808\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 8808, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 8808}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 8808 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228808\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228808\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":516},{"id":11014350,"ip":"45.92.17.75","ts":"2026-10-31 04:10:28.000000","proto":"tcp","src_port":6736,"dst_port":30103,"service":"tls","classification":"tls","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002220b279993ae2e137e62b9647c6d768fb\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022bytes_in\u0022: 1533, \u0022payload_entropy\u0022: 7.745243690239623, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 30103, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 0.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00220a3484de766e8e9145f03a305e5016a791698b72\u0022, \u0022event_fingerprint\u0022: \u00220d726ff778b6b24f89d106bdd8a1924d2d91484f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002220b279993ae2e137e62b9647c6d768fb\u0022, \u0022payload_hash\u0022: \u0022879392c678193306a45b1a645f9438f1\u0022, \u0022path_pattern_hash\u0022: \u0022b7e651cbb43ba0ca3498759c8c3596c3\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 30103, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 0}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd(x\u03daN\ufffd\ufffd\ufffd\ufffdj\\\\\ufffdF\ufffd)\ufffd h\ufffd\ufffd\ufffd\ufffd\ufffd\u0413\ufffd;n; \ufffd\u03b8\ufffdI|\ufffd\ufffd\\u0012\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdKTO\ufffd\ufffd#N+%\ufffdn\ufffd\ufffd\ufffdh\\n\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005\ufffd\\u0000\\u0000\\u0000.\\u0000,\\u0000\\u0000)ip-62-3-50-\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd(x\u03daN\ufffd\ufffd\ufffd\ufffdj\\\\\ufffdF\ufffd)\ufffd h\ufffd\ufffd\ufffd\ufffd\ufffd\u0413\ufffd;n; \ufffd\u03b8\ufffdI|\ufffd\ufffd\\u0012\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdKTO\ufffd\ufffd#N+%\ufffdn\ufffd\ufffd\ufffdh\\n\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005\ufffd\\u0000\\u0000\\u0000.\\u0000,\\u0000\\u0000)ip-62-3-50-33.v4.isp.servpersosystems.net\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u0016\\u0000\\u0014\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u00002\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd(x\u03daN\ufffd\ufffd\ufffd\ufffdj\\\\\ufffdF\ufffd)\ufffd h\ufffd\ufffd\ufffd\ufffd\ufffd\u0413\ufffd;n; \ufffd\u03b8\ufffdI|\ufffd\ufffd\\u0012\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdKTO\ufffd\ufffd#N+%\ufffdn\ufffd\ufffd\ufffdh\\n\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005\ufffd\\u0000\\u0000\\u0000.\\u0000,\\u0000\\u0000)ip-62-3-50-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d3fa3fab0d90a56d1dd539ff558e5532cb8c49ac\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd(x\u03daN\ufffd\ufffd\ufffd\ufffdj\\\\\ufffdF\ufffd)\ufffd h\ufffd\ufffd\ufffd\ufffd\ufffd\u0413\ufffd;n; \ufffd\u03b8\ufffdI|\ufffd\ufffd\\u0012\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdKTO\ufffd\ufffd#N+%\ufffdn\ufffd\ufffd\ufffdh\\n\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005\ufffd\\u0000\\u0000\\u0000.\\u0000,\\u0000\\u0000)ip-62-3-50-\u0022, \u0022tls_ja3\u0022: \u002220b279993ae2e137e62b9647c6d768fb\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022port\u0022: 30103, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd(x\u03daN\ufffd\ufffd\ufffd\ufffdj\\\\\ufffdF\ufffd)\ufffd h\ufffd\ufffd\ufffd\ufffd\ufffd\u0413\ufffd;n; \ufffd\u03b8\ufffdI|\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdKTO\ufffd\ufffd#N+%\ufffdn\ufffd\ufffd\ufffdh\\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd\ufffd.,)ip-62-3-50-\u0022, \u0022attack_vector\u0022: \u0022tls \u00b7 via TLS:30103 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002230103 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 30103, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd(x\u03daN\ufffd\ufffd\ufffd\ufffdj\\\\\ufffdF\ufffd)\ufffd h\ufffd\ufffd\ufffd\ufffd\ufffd\u0413\ufffd;n; \ufffd\u03b8\ufffdI|\ufffd\ufffd\\u0012\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdKTO\ufffd\ufffd#N+%\ufffdn\ufffd\ufffd\ufffdh\\n\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005\ufffd\\u0000\\u0000\\u0000.\\u0000,\\u0000\\u0000)ip-62-3-50-\u0022, \u0022tls_ja3\u0022: \u002220b279993ae2e137e62b9647c6d768fb\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022port\u0022: 30103, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls \u00b7 via TLS:30103 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd(x\u03daN\ufffd\ufffd\ufffd\ufffdj\\\\\ufffdF\ufffd)\ufffd h\ufffd\ufffd\ufffd\ufffd\ufffd\u0413\ufffd;n; \ufffd\u03b8\ufffdI|\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdKTO\ufffd\ufffd#N+%\ufffdn\ufffd\ufffd\ufffdh\\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd\ufffd.,)ip-62-3-50-\u0022, \u0022target_port_label\u0022: \u002230103 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002230103\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022]}","tls_sni":"ip-62-3-50-33.v4.isp.servpersosystems.net","tls_ja3_hash":"20b279993ae2e137e62b9647c6d768fb","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022]","anomalies":"[]","severity":0,"bytes_in":1533},{"id":10850139,"ip":"45.92.17.75","ts":"2026-10-30 19:46:30.000000","proto":"tcp","src_port":21870,"dst_port":8865,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022790a1d8d1493d774ee6bc3d09bee104c\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 2, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 529, \u0022payload_entropy\u0022: 6.776036875573855, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8865, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 5.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022604352552d87ad9eccf735173c2ccfd6e6d71cd0\u0022, \u0022event_fingerprint\u0022: \u0022f81179a83de12153653d28c3083c3bcc094dff7c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022790a1d8d1493d774ee6bc3d09bee104c\u0022, \u0022payload_hash\u0022: \u0022f7e495c2539e3ead01aac465a54f8e87\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8865, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\f\\u0001\\u0000\\u0002\\b\\u0003\\u0003\ufffd\ufffd\ufffd%\ufffd\ufffd1@\ufffd\\\u0022\\u0001A\ufffdeKu1\ufffd\ufffdY\ufffd,\ufffd\ufffd08\ufffd9\u03ae j\u054c\ufffd7\u003Cu\\\\\ufffd\\\u0022\ufffd\ufffdf\u073f\ufffd\u003ES\\u0012\ufffd;d-4!\ufffd\ufffd\ufffd\ufffdb7\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\f\\u0001\\u0000\\u0002\\b\\u0003\\u0003\ufffd\ufffd\ufffd%\ufffd\ufffd1@\ufffd\\\u0022\\u0001A\ufffdeKu1\ufffd\ufffdY\ufffd,\ufffd\ufffd08\ufffd9\u03ae j\u054c\ufffd7\u003Cu\\\\\ufffd\\\u0022\ufffd\ufffdf\u073f\ufffd\u003ES\\u0012\ufffd;d-4!\ufffd\ufffd\ufffd\ufffdb7\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\n\\u0000\\n\\u0000\\bjj\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u001b\\u0000\\u0003\\u0002\\u0000\\u0002\\u0000+\\u0000\\u0007\\u0006JJ\\u0003\\u0004\\u0003\\u0003\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000\\u0000\\u0000.\\u0000,\\u0000\\u0000)ip-62-3-50-33.v4.isp.servpersosy\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\f\\u0001\\u0000\\u0002\\b\\u0003\\u0003\ufffd\ufffd\ufffd%\ufffd\ufffd1@\ufffd\\\u0022\\u0001A\ufffdeKu1\ufffd\ufffdY\ufffd,\ufffd\ufffd08\ufffd9\u03ae j\u054c\ufffd7\u003Cu\\\\\ufffd\\\u0022\ufffd\ufffdf\u073f\ufffd\u003ES\\u0012\ufffd;d-4!\ufffd\ufffd\ufffd\ufffdb7\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ee4be68b07ab7a53e473d7dafe7b7f63d09dd630\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\f\\u0001\\u0000\\u0002\\b\\u0003\\u0003\ufffd\ufffd\ufffd%\ufffd\ufffd1@\ufffd\\\u0022\\u0001A\ufffdeKu1\ufffd\ufffdY\ufffd,\ufffd\ufffd08\ufffd9\u03ae j\u054c\ufffd7\u003Cu\\\\\ufffd\\\u0022\ufffd\ufffdf\u073f\ufffd\u003ES\\u0012\ufffd;d-4!\ufffd\ufffd\ufffd\ufffdb7\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022790a1d8d1493d774ee6bc3d09bee104c\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022port\u0022: 8865, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd%\ufffd\ufffd1@\ufffd\\\u0022A\ufffdeKu1\ufffd\ufffdY\ufffd,\ufffd\ufffd08\ufffd9\u03ae j\u054c\ufffd7\u003Cu\\\\\ufffd\\\u0022\ufffd\ufffdf\u073f\ufffd\u003ES\ufffd;d-4!\ufffd\ufffd\ufffd\ufffdb7 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8865 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228865 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8865, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\f\\u0001\\u0000\\u0002\\b\\u0003\\u0003\ufffd\ufffd\ufffd%\ufffd\ufffd1@\ufffd\\\u0022\\u0001A\ufffdeKu1\ufffd\ufffdY\ufffd,\ufffd\ufffd08\ufffd9\u03ae j\u054c\ufffd7\u003Cu\\\\\ufffd\\\u0022\ufffd\ufffdf\u073f\ufffd\u003ES\\u0012\ufffd;d-4!\ufffd\ufffd\ufffd\ufffdb7\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022790a1d8d1493d774ee6bc3d09bee104c\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022port\u0022: 8865, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8865 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd%\ufffd\ufffd1@\ufffd\\\u0022A\ufffdeKu1\ufffd\ufffdY\ufffd,\ufffd\ufffd08\ufffd9\u03ae j\u054c\ufffd7\u003Cu\\\\\ufffd\\\u0022\ufffd\ufffdf\u073f\ufffd\u003ES\ufffd;d-4!\ufffd\ufffd\ufffd\ufffdb7 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::\u0022, \u0022target_port_label\u0022: \u00228865 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228865\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":"ip-62-3-50-33.v4.isp.servpersosystems.net","tls_ja3_hash":"790a1d8d1493d774ee6bc3d09bee104c","tls_ja3":"771,51914-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,14906-11-23-45-10-16-27-43-5-13-0-18-35-65037-17513-51-65281-64250,27242-29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":529},{"id":10813837,"ip":"45.92.17.75","ts":"2026-10-30 17:58:32.000000","proto":"tcp","src_port":59774,"dst_port":8907,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00222b1d8c344d2350b580b3f6cf9fc2b45e\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 2, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 593, \u0022payload_entropy\u0022: 6.943209987453243, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8907, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 2.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e8f0c8e804c27b13ee7b597c99dba7113dd36883\u0022, \u0022event_fingerprint\u0022: \u00222a29e8258b2f9f590eaaa4599a236a8dac352a8d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.08, \u0022classification_confidence\u0022: 0.08, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00222b1d8c344d2350b580b3f6cf9fc2b45e\u0022, \u0022payload_hash\u0022: \u002282196c5844f88aefa52f97e647f911d7\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8907, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002L\\u0001\\u0000\\u0002H\\u0003\\u0003\ufffdpbJ\ufffds\\u0016g\ufffd\ufffd\ufffd{C\u00de\u0345\ufffd\ufffd;\ufffdb\ufffd\\u0007\ufffd\ufffd;RJ\ufffd E\ufffd\ufffd\ufffd\ufffd\\u000b\ufffd\\b\ufffd\ufffdY\ufffd\ufffd\ufffd\\u0000T\ufffd\\u0000\u0687\ufffdx;\ufffd\\u001aW@_\ufffd\u0026P\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdZZ\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002L\\u0001\\u0000\\u0002H\\u0003\\u0003\ufffdpbJ\ufffds\\u0016g\ufffd\ufffd\ufffd{C\u00de\u0345\ufffd\ufffd;\ufffdb\ufffd\\u0007\ufffd\ufffd;RJ\ufffd E\ufffd\ufffd\ufffd\ufffd\\u000b\ufffd\\b\ufffd\ufffdY\ufffd\ufffd\ufffd\\u0000T\ufffd\\u0000\u0687\ufffdx;\ufffd\\u001aW@_\ufffd\u0026P\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdZZ\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\\u0001\\u0000\\u0001\ufffd\\u0000 W\ufffd\\u001bP\ufffd\ufffd@\ufffd_\ufffduhK}\ufffdS1\u1493\ufffd\\u0004pk\ufffd\ufffd*\ufffdw\\u0000\ufffd\ufffd\ufffd\ufffd\ufffdc\\u000b\ufffd\ufffd\ufffd^P\ufffd\ufffdi\ufffd\ufffd\\u0016g\\u0016\\u0000Z+\ufffd?\\u001f\ufffd\ufffd\\u0015\ufffd\ufffd\\u001b\ufffd\ufffd\ufffdy\\u0005\ufffd\ufffd\\u0006T\ufffd]\\u0010\u0026\ufffd\ufffdC\ufffdK\\u0005\ufffd\\u001aC\ufffd\ufffd\ufffdS.\ufffdM\ufffd\ufffdd+\\u001d\\u0002\\u0002\ufffd\\u00062#\\u00166\u0026\ufffd\\\\\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002L\\u0001\\u0000\\u0002H\\u0003\\u0003\ufffdpbJ\ufffds\\u0016g\ufffd\ufffd\ufffd{C\u00de\u0345\ufffd\ufffd;\ufffdb\ufffd\\u0007\ufffd\ufffd;RJ\ufffd E\ufffd\ufffd\ufffd\ufffd\\u000b\ufffd\\b\ufffd\ufffdY\ufffd\ufffd\ufffd\\u0000T\ufffd\\u0000\u0687\ufffdx;\ufffd\\u001aW@_\ufffd\u0026P\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdZZ\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002295a8478ee913d03f84e85e08ae5bafb002e39156\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002L\\u0001\\u0000\\u0002H\\u0003\\u0003\ufffdpbJ\ufffds\\u0016g\ufffd\ufffd\ufffd{C\u00de\u0345\ufffd\ufffd;\ufffdb\ufffd\\u0007\ufffd\ufffd;RJ\ufffd E\ufffd\ufffd\ufffd\ufffd\\u000b\ufffd\\b\ufffd\ufffdY\ufffd\ufffd\ufffd\\u0000T\ufffd\\u0000\u0687\ufffdx;\ufffd\\u001aW@_\ufffd\u0026P\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdZZ\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u00222b1d8c344d2350b580b3f6cf9fc2b45e\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022port\u0022: 8907, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022LH\ufffdpbJ\ufffdsg\ufffd\ufffd\ufffd{C\u00de\u0345\ufffd\ufffd;\ufffdb\ufffd\ufffd\ufffd;RJ\ufffd E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffdT\ufffd\u0687\ufffdx;\ufffdW@_\ufffd\u0026P \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdZZ#\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8907 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228907 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 8, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8907, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002L\\u0001\\u0000\\u0002H\\u0003\\u0003\ufffdpbJ\ufffds\\u0016g\ufffd\ufffd\ufffd{C\u00de\u0345\ufffd\ufffd;\ufffdb\ufffd\\u0007\ufffd\ufffd;RJ\ufffd E\ufffd\ufffd\ufffd\ufffd\\u000b\ufffd\\b\ufffd\ufffdY\ufffd\ufffd\ufffd\\u0000T\ufffd\\u0000\u0687\ufffdx;\ufffd\\u001aW@_\ufffd\u0026P\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdZZ\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u00222b1d8c344d2350b580b3f6cf9fc2b45e\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022port\u0022: 8907, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8907 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022LH\ufffdpbJ\ufffdsg\ufffd\ufffd\ufffd{C\u00de\u0345\ufffd\ufffd;\ufffdb\ufffd\ufffd\ufffd;RJ\ufffd E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffdT\ufffd\u0687\ufffdx;\ufffdW@_\ufffd\u0026P \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdZZ#\u0022, \u0022target_port_label\u0022: \u00228907 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228907\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022port:8907\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_weak_cipher\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":"ip-62-3-50-33.v4.isp.servpersosystems.net","tls_ja3_hash":"2b1d8c344d2350b580b3f6cf9fc2b45e","tls_ja3":"771,51914-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23130-35-11-65037-23-51-16-10-13-45-18-0-65281-27-43-17513-5-2570,31354-29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":593},{"id":10813769,"ip":"45.92.17.75","ts":"2026-10-30 17:58:21.000000","proto":"tcp","src_port":11594,"dst_port":8907,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 501, \u0022payload_entropy\u0022: 3.7940870380940184, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8907, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c58b3c5dc904b5cf98de9ff98882c53c5b4ba2ba\u0022, \u0022event_fingerprint\u0022: \u0022b8b622aa6f1352841b19041c28581ce811d5c885\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002229b5329f45e73a6677bca0caf0ca278c\u0022, \u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8907, \u0022risk_score\u0022: 44}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000\\u0012\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0010sH\\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\\u0014\\u001d\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002219849c2a05815e9d706192b3bd22a9cfd153d628\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 8907}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 8907 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228907\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 8907, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 8907}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 8907 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228907\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228907\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":501},{"id":10807441,"ip":"45.92.17.75","ts":"2026-10-30 17:39:34.000000","proto":"tcp","src_port":16500,"dst_port":3155,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 516, \u0022payload_entropy\u0022: 3.9791255536617784, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 3155, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022409077b50689515480b3ed2c3421ee423fb33c27\u0022, \u0022event_fingerprint\u0022: \u0022ab223c63c496d45213446d5326b59cbbe5ba4af7\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a2a0ad11f9f8f1cf9217197b97b6f064\u0022, \u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3155, \u0022risk_score\u0022: 44}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000\\u0012\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0010sH\\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\\u0014\\u001d\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002224d5cff831c16babd7e6ee940da61517d7846a99\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 3155}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 3155 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00223155\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 3155, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 3155}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 3155 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00223155\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223155\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":516},{"id":10805633,"ip":"45.92.17.75","ts":"2026-10-30 17:34:08.000000","proto":"tcp","src_port":37806,"dst_port":5901,"service":"vnc","classification":"vnc_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 542, \u0022payload_entropy\u0022: 4.161650730260368, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022vnc\u0022, \u0022app_proto\u0022: \u0022vnc\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 5901, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 52.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 28.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 28.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 34, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222981b6dfad870ce476ee5b210b89c1f2966415a2\u0022, \u0022event_fingerprint\u0022: \u0022ad9df2f55eb97f2ead632d4cf4d9fedf3abf3d39\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 28.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022vnc\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224509eec7340acca41e94bc6bae32c197\u0022, \u0022path_pattern_hash\u0022: \u002261f146998107ee0d48dcdbbf16d99fc0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5901, \u0022service\u0022: \u0022vnc\u0022, \u0022service_name\u0022: \u0022vnc\u0022, \u0022risk_score\u0022: 34}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000\\u0012\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0010sH\\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\\u0014\\u001d\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b554c7756c1cca4724c0aceac8bed25a4e7ea7b9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 5901, \u0022service\u0022: \u0022vnc\u0022, \u0022service_label_fr\u0022: \u0022VNC\u0022}, \u0022evidence_snippet\u0022: \u0022\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022vnc probe \u00b7 via VNC:5901 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225901 \u00b7 VNC\u0022, \u0022emulator_service\u0022: \u0022vnc\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab vnc_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 34\/100\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 52.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 28.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 34}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 34, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022vnc\u0022, \u0022service_label_fr\u0022: \u0022VNC\u0022, \u0022dst_port\u0022: 5901, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-vnc\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 5901, \u0022service\u0022: \u0022vnc\u0022, \u0022service_label_fr\u0022: \u0022VNC\u0022}, \u0022attack_vector\u0022: \u0022vnc probe \u00b7 via VNC:5901 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00225901 \u00b7 VNC\u0022, \u0022emulator_service\u0022: \u0022vnc\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022vnc\u0022, \u0022service_banner\u0022: \u0022honeypot-vnc\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225901\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":6,"bytes_in":542},{"id":10800004,"ip":"45.92.17.75","ts":"2026-10-30 17:17:28.000000","proto":"tcp","src_port":28828,"dst_port":19091,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022e094eeca587ae860e39089a0b4aebc6f\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 2, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 503, \u0022payload_entropy\u0022: 6.739198478980216, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 19091, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225024a6a6ddf3b828dc2961062cf69f2eccdbe06a\u0022, \u0022event_fingerprint\u0022: \u0022bacd237e63a291fbbc88fde8cf1c2029071b5dbe\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.08, \u0022classification_confidence\u0022: 0.08, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022e094eeca587ae860e39089a0b4aebc6f\u0022, \u0022payload_hash\u0022: \u0022967fb14aa13c17210b669874fd808e9f\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 19091, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd|\u077a\\u0014\ufffdq\ufffd\ufffdk\\u001c\u035c\ufffd\\u0014\ufffd\\\u0022*\\u0004\ufffd\u5c3c\ufffd,`\\u001br\ufffd0\u003E\ufffd \u003E\ufffd\ufffd\\u000fh\ufffd\\f\ufffd4\ufffd7\/u\ufffdoAd\ufffd\ufffd\ufffd\u04c0*\ufffdC}\u06ee\u04ed\ufffd\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0007\\u0006Z\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd|\u077a\\u0014\ufffdq\ufffd\ufffdk\\u001c\u035c\ufffd\\u0014\ufffd\\\u0022*\\u0004\ufffd\u5c3c\ufffd,`\\u001br\ufffd0\u003E\ufffd \u003E\ufffd\ufffd\\u000fh\ufffd\\f\ufffd4\ufffd7\/u\ufffdoAd\ufffd\ufffd\ufffd\u04c0*\ufffdC}\u06ee\u04ed\ufffd\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0007\\u0006ZZ\\u0003\\u0004\\u0003\\u0003\\u0000\\n\\u0000\\n\\u0000\\b\ufffd\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018Di\\u0000\\u0005\\u0000\\u0003\\u0002h2\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0014\\u0000\\u0012\\u0000\\u0000\\u000fblacklistip.com\\u0000\\u0012\\u0000\\u0000\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0017\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\\u0001\\u0000\\u0001 \\u0000 4\ufffdC\u058c\ufffd\u03e2\ufffd.\\u0012\ufffd;\\fD\\r\\u0015\ufffdn\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd|\u077a\\u0014\ufffdq\ufffd\ufffdk\\u001c\u035c\ufffd\\u0014\ufffd\\\u0022*\\u0004\ufffd\u5c3c\ufffd,`\\u001br\ufffd0\u003E\ufffd \u003E\ufffd\ufffd\\u000fh\ufffd\\f\ufffd4\ufffd7\/u\ufffdoAd\ufffd\ufffd\ufffd\u04c0*\ufffdC}\u06ee\u04ed\ufffd\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0007\\u0006Z\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002262027611dd2c27b047b61d60010d925f80cf4a5a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd|\u077a\\u0014\ufffdq\ufffd\ufffdk\\u001c\u035c\ufffd\\u0014\ufffd\\\u0022*\\u0004\ufffd\u5c3c\ufffd,`\\u001br\ufffd0\u003E\ufffd \u003E\ufffd\ufffd\\u000fh\ufffd\\f\ufffd4\ufffd7\/u\ufffdoAd\ufffd\ufffd\ufffd\u04c0*\ufffdC}\u06ee\u04ed\ufffd\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0007\\u0006Z\u0022, \u0022tls_ja3\u0022: \u0022e094eeca587ae860e39089a0b4aebc6f\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022, \u0022port\u0022: 19091, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd|\u077a\ufffdq\ufffd\ufffdk\u035c\ufffd\ufffd\\\u0022*\ufffd\u5c3c\ufffd,`r\ufffd0\u003E\ufffd \u003E\ufffd\ufffdh\ufffd\ufffd4\ufffd7\/u\ufffdoAd\ufffd\ufffd\ufffd\u04c0*\ufffdC}\u06ee\u04ed\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::#+Z\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:19091 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002219091 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 8, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 19091, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd|\u077a\\u0014\ufffdq\ufffd\ufffdk\\u001c\u035c\ufffd\\u0014\ufffd\\\u0022*\\u0004\ufffd\u5c3c\ufffd,`\\u001br\ufffd0\u003E\ufffd \u003E\ufffd\ufffd\\u000fh\ufffd\\f\ufffd4\ufffd7\/u\ufffdoAd\ufffd\ufffd\ufffd\u04c0*\ufffdC}\u06ee\u04ed\ufffd\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000+\\u0000\\u0007\\u0006Z\u0022, \u0022tls_ja3\u0022: \u0022e094eeca587ae860e39089a0b4aebc6f\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022, \u0022port\u0022: 19091, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:19091 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd|\u077a\ufffdq\ufffd\ufffdk\u035c\ufffd\ufffd\\\u0022*\ufffd\u5c3c\ufffd,`r\ufffd0\u003E\ufffd \u003E\ufffd\ufffdh\ufffd\ufffd4\ufffd7\/u\ufffdoAd\ufffd\ufffd\ufffd\u04c0*\ufffdC}\u06ee\u04ed\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::#+Z\u0022, \u0022target_port_label\u0022: \u002219091 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002219091\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022port:19091\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":"blacklistip.com","tls_ja3_hash":"e094eeca587ae860e39089a0b4aebc6f","tls_ja3":"771,51914-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,14906-35-43-10-17513-5-0-18-13-45-23-65037-65281-16-51-11-27-31354,51914-29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":503},{"id":10799976,"ip":"45.92.17.75","ts":"2026-10-30 17:17:23.000000","proto":"tcp","src_port":65360,"dst_port":19091,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 516, \u0022payload_entropy\u0022: 3.9791255536617784, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 19091, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00226b3f14793b4ee45894d34d1e6d539004e308c4a2\u0022, \u0022event_fingerprint\u0022: \u0022bdf2b3d16bef1179d65c60384197b447de3559e9\u0022, \u0022classification_confidence\u0022: 0.5, \u0022confidence\u0022: 0.5, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a2a0ad11f9f8f1cf9217197b97b6f064\u0022, \u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 19091, \u0022risk_score\u0022: 44}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000\\u0012\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0010sH\\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\\u0014\\u001d\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223c6ef4c79c31d90ad9504e0bb94460ff1f6cadb4\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 19091}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 19091 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002219091\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 19091, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 19091}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 19091 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u002219091\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002219091\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":516},{"id":10785727,"ip":"45.92.17.75","ts":"2026-10-30 16:34:46.000000","proto":"tcp","src_port":11782,"dst_port":10019,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022dc32b85763a66fe452d2a84dc14c1401\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 2, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 535, \u0022payload_entropy\u0022: 6.863144248181482, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 10019, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c5f8475dfd1787f772afe788311bfb66fa4145d0\u0022, \u0022event_fingerprint\u0022: \u0022596c102832f8ba47b5fdc2088f1a6489d3339919\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022dc32b85763a66fe452d2a84dc14c1401\u0022, \u0022payload_hash\u0022: \u0022b8b675d976833b10ad4b0067385a46a3\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10019, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0012\\u0001\\u0000\\u0002\\u000e\\u0003\\u0003\ufffdE\ufffd\ufffd\ufffd\\bET\ufffd\ufffd\u03cf\ufffd\ufffd\ufffd\ufffdt\ufffd\u00a9\ufffdW\ufffd\ufffd0\ufffdp\u063a[\ufffd= \ufffd\ufffdo\ufffdY\ufffd\ufffd\u0116\\rg\\u0002\ufffd\ufffd\ufffdCy(\ufffd\\u001d\\u0001\ufffd.\ufffd\\u001d\\u0002E\ufffd\ufffd\\u000bz\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd**\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0014\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0012\\u0001\\u0000\\u0002\\u000e\\u0003\\u0003\ufffdE\ufffd\ufffd\ufffd\\bET\ufffd\ufffd\u03cf\ufffd\ufffd\ufffd\ufffdt\ufffd\u00a9\ufffdW\ufffd\ufffd0\ufffdp\u063a[\ufffd= \ufffd\ufffdo\ufffdY\ufffd\ufffd\u0116\\rg\\u0002\ufffd\ufffd\ufffdCy(\ufffd\\u001d\\u0001\ufffd.\ufffd\\u001d\\u0002E\ufffd\ufffd\\u000bz\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd**\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0014\\u0000\\u0012\\u0000\\u0000\\u000fblacklistip.com\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u001b\\u0000\\u0003\\u0002\\u0000\\u0002\\u0000+\\u0000\\u0007\\u0006**\\u0003\\u0004\\u0003\\u0003\\u0000\\u0012\\u0000\\u0000\\u00003\\u0000+\\u0000)::\\u0000\\u0001\\u0000\\u0000\\u001d\\u0000 \ufffd\ufffd5\ufffd\ufffd6\ufffd\\u001f\ufffd\ufffd\ufffdV?\\u0011Q\\r\ufffd\\u0016\ufffd\/\\u0014\ufffd\ufffd\\u0017\ufffdTVA\ufffd!e^\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000#\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0012\\u0001\\u0000\\u0002\\u000e\\u0003\\u0003\ufffdE\ufffd\ufffd\ufffd\\bET\ufffd\ufffd\u03cf\ufffd\ufffd\ufffd\ufffdt\ufffd\u00a9\ufffdW\ufffd\ufffd0\ufffdp\u063a[\ufffd= \ufffd\ufffdo\ufffdY\ufffd\ufffd\u0116\\rg\\u0002\ufffd\ufffd\ufffdCy(\ufffd\\u001d\\u0001\ufffd.\ufffd\\u001d\\u0002E\ufffd\ufffd\\u000bz\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd**\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0014\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224e8c741abb1ca07474ed39061e250a7a321b7651\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0012\\u0001\\u0000\\u0002\\u000e\\u0003\\u0003\ufffdE\ufffd\ufffd\ufffd\\bET\ufffd\ufffd\u03cf\ufffd\ufffd\ufffd\ufffdt\ufffd\u00a9\ufffdW\ufffd\ufffd0\ufffdp\u063a[\ufffd= \ufffd\ufffdo\ufffdY\ufffd\ufffd\u0116\\rg\\u0002\ufffd\ufffd\ufffdCy(\ufffd\\u001d\\u0001\ufffd.\ufffd\\u001d\\u0002E\ufffd\ufffd\\u000bz\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd**\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0014\\u0000\u0022, \u0022tls_ja3\u0022: \u0022dc32b85763a66fe452d2a84dc14c1401\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022, \u0022port\u0022: 10019, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdE\ufffd\ufffd\ufffdET\ufffd\ufffd\u03cf\ufffd\ufffd\ufffd\ufffdt\ufffd\u00a9\ufffdW\ufffd\ufffd0\ufffdp\u063a[\ufffd= \ufffd\ufffdo\ufffdY\ufffd\ufffd\u0116\\rg\ufffd\ufffd\ufffdCy(\ufffd\ufffd.\ufffdE\ufffd\ufffdz\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd**\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:10019 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002210019 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 10019, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0012\\u0001\\u0000\\u0002\\u000e\\u0003\\u0003\ufffdE\ufffd\ufffd\ufffd\\bET\ufffd\ufffd\u03cf\ufffd\ufffd\ufffd\ufffdt\ufffd\u00a9\ufffdW\ufffd\ufffd0\ufffdp\u063a[\ufffd= \ufffd\ufffdo\ufffdY\ufffd\ufffd\u0116\\rg\\u0002\ufffd\ufffd\ufffdCy(\ufffd\\u001d\\u0001\ufffd.\ufffd\\u001d\\u0002E\ufffd\ufffd\\u000bz\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd**\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0014\\u0000\u0022, \u0022tls_ja3\u0022: \u0022dc32b85763a66fe452d2a84dc14c1401\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022, \u0022port\u0022: 10019, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:10019 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdE\ufffd\ufffd\ufffdET\ufffd\ufffd\u03cf\ufffd\ufffd\ufffd\ufffdt\ufffd\u00a9\ufffdW\ufffd\ufffd0\ufffdp\u063a[\ufffd= \ufffd\ufffdo\ufffdY\ufffd\ufffd\u0116\\rg\ufffd\ufffd\ufffdCy(\ufffd\ufffd.\ufffdE\ufffd\ufffdz\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd**\ufffd\u0022, \u0022target_port_label\u0022: \u002210019 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210019\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_weak_cipher\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":"blacklistip.com","tls_ja3_hash":"dc32b85763a66fe452d2a84dc14c1401","tls_ja3":"771,47802-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10794-65281-0-5-27-43-18-51-45-13-35-10-23-17513-65037-16-11-31354,14906-29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":535},{"id":10782330,"ip":"45.92.17.75","ts":"2026-10-30 16:24:56.000000","proto":"tcp","src_port":45798,"dst_port":8881,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 1483, \u0022payload_entropy\u0022: 7.758270945689535, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8881, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00228320d4a16454971a7a359f6bde3ea7368c780dee\u0022, \u0022event_fingerprint\u0022: \u00223bd39b0d3e2235a0fb2cdb9834521f1ba0d3b6c7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022payload_hash\u0022: \u00222c7862b72d4cf7599171f556b2c2c7c6\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8881, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\u0176\ufffdX\ufffd\ufffd\\u000e\ufffd\\u0013\ufffd!\ufffd\\r\ufffd\ufffd\ufffd)r9\\t\\u001a\u0537\ufffda\ufffd,x\ufffd \ufffd\ufffd\u04a6\u003C\\u0002\ufffd\ufffd\u0672\ufffd\ufffdv\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffd\ufffdZz\\u001b\ufffdK`lo#\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\u0176\ufffdX\ufffd\ufffd\\u000e\ufffd\\u0013\ufffd!\ufffd\\r\ufffd\ufffd\ufffd)r9\\t\\u001a\u0537\ufffda\ufffd,x\ufffd \ufffd\ufffd\u04a6\u003C\\u0002\ufffd\ufffd\u0672\ufffd\ufffdv\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffd\ufffdZz\\u001b\ufffdK`lo#\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u0016\\u0000\\u0014\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u00002\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\\u0003\\u0003\\u0002\\u0003\\u0001\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd\ufffd\ufffd1\\u0012\ufffd(]W\\u000bRd\ufffd{\u0027\\u0000\ufffd\\\\!u\ufffdT\ufffdg\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\u0176\ufffdX\ufffd\ufffd\\u000e\ufffd\\u0013\ufffd!\ufffd\\r\ufffd\ufffd\ufffd)r9\\t\\u001a\u0537\ufffda\ufffd,x\ufffd \ufffd\ufffd\u04a6\u003C\\u0002\ufffd\ufffd\u0672\ufffd\ufffdv\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffd\ufffdZz\\u001b\ufffdK`lo#\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ffed8f94944812941d4c6f778dc587f5a840f007\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\u0176\ufffdX\ufffd\ufffd\\u000e\ufffd\\u0013\ufffd!\ufffd\\r\ufffd\ufffd\ufffd)r9\\t\\u001a\u0537\ufffda\ufffd,x\ufffd \ufffd\ufffd\u04a6\u003C\\u0002\ufffd\ufffd\u0672\ufffd\ufffdv\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffd\ufffdZz\\u001b\ufffdK`lo#\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022port\u0022: 8881, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\u0176\ufffdX\ufffd\ufffd\ufffd\ufffd!\ufffd\\r\ufffd\ufffd\ufffd)r9\\t\u0537\ufffda\ufffd,x\ufffd \ufffd\ufffd\u04a6\u003C\ufffd\ufffd\u0672\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZz\ufffdK`lo#\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd_\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8881 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228881 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8881, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\u0176\ufffdX\ufffd\ufffd\\u000e\ufffd\\u0013\ufffd!\ufffd\\r\ufffd\ufffd\ufffd)r9\\t\\u001a\u0537\ufffda\ufffd,x\ufffd \ufffd\ufffd\u04a6\u003C\\u0002\ufffd\ufffd\u0672\ufffd\ufffdv\ufffd\ufffd\\u0012\ufffd\ufffd\ufffd\ufffd\ufffdZz\\u001b\ufffdK`lo#\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022port\u0022: 8881, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8881 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\u0176\ufffdX\ufffd\ufffd\ufffd\ufffd!\ufffd\\r\ufffd\ufffd\ufffd)r9\\t\u0537\ufffda\ufffd,x\ufffd \ufffd\ufffd\u04a6\u003C\ufffd\ufffd\u0672\ufffd\ufffdv\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdZz\ufffdK`lo#\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd_\ufffd\u0022, \u0022target_port_label\u0022: \u00228881 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228881\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":1483},{"id":10760014,"ip":"45.92.17.75","ts":"2026-10-30 15:17:59.000000","proto":"tcp","src_port":40216,"dst_port":6443,"service":"k8s-api","classification":"kubernetes_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002215030300020228\u0022, \u0022emulator_response_len\u0022: 7, \u0022bytes_in\u0022: 1483, \u0022payload_entropy\u0022: 7.7319694216719, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022k8s-api\u0022, \u0022app_proto\u0022: \u0022k8s-api\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 6443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 62.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225f70a73a5934201c2e00970f23615f0b69d2ca8a\u0022, \u0022event_fingerprint\u0022: \u00225535c85e0f6854b807e5b9ef895f87dbea310cc1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.08, \u0022classification_confidence\u0022: 0.08, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c22c122e8cbc4488b3acc2c4fed73e4f\u0022, \u0022path_pattern_hash\u0022: \u00229911336c7fd1406c8e284bedc6c69f4b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdjo\ufffd$\u9b01\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\\u00103\ufffd\\b\ufffd\ufffd\ufffd\u003E\\u001fu\ufffd)vl\ufffdV _R\ufffd~sV\\u001d\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffd \ufffd\ufffd?\ufffd\ufffd9\ufffd\ufffd\ufffdi}\ufffd\ufffdH\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdjo\ufffd$\u9b01\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\\u00103\ufffd\\b\ufffd\ufffd\ufffd\u003E\\u001fu\ufffd)vl\ufffdV _R\ufffd~sV\\u001d\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffd \ufffd\ufffd?\ufffd\ufffd9\ufffd\ufffd\ufffdi}\ufffd\ufffdH\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u0016\\u0000\\u0014\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u00002\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\\u0003\\u0003\\u0002\\u0003\\u0001\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd\ufffdEX\ufffdQO\ufffd\ufffdi\ufffd\u06a4\ufffd\u04bf\ufffd!s\\u001b\ufffd8\ud049\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdjo\ufffd$\u9b01\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\\u00103\ufffd\\b\ufffd\ufffd\ufffd\u003E\\u001fu\ufffd)vl\ufffdV _R\ufffd~sV\\u001d\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffd \ufffd\ufffd?\ufffd\ufffd9\ufffd\ufffd\ufffdi}\ufffd\ufffdH\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022518749bf8d94d8d4605d44c6d25260235455c234\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdjo\ufffd$\u9b01\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\\u00103\ufffd\\b\ufffd\ufffd\ufffd\u003E\\u001fu\ufffd)vl\ufffdV _R\ufffd~sV\\u001d\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffd \ufffd\ufffd?\ufffd\ufffd9\ufffd\ufffd\ufffdi}\ufffd\ufffdH\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdjo\ufffd$\u9b01\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\u003Eu\ufffd)vl\ufffdV _R\ufffd~sV\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd?\ufffd\ufffd9\ufffd\ufffd\ufffdi}\ufffd\ufffdH\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd_\ufffd\u0022, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 5 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab kubernetes_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 8, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 62.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022, \u0022dst_port\u0022: 6443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdjo\ufffd$\u9b01\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd\\u00103\ufffd\\b\ufffd\ufffd\ufffd\u003E\\u001fu\ufffd)vl\ufffdV _R\ufffd~sV\\u001d\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\ufffd \ufffd\ufffd?\ufffd\ufffd9\ufffd\ufffd\ufffdi}\ufffd\ufffdH\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 6443, \u0022service\u0022: \u0022k8s-api\u0022, \u0022service_label_fr\u0022: \u0022K8S API\u0022}, \u0022attack_vector\u0022: \u0022kubernetes probe \u00b7 via K8S API:6443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdjo\ufffd$\u9b01\ufffd\ufffd\ufffda\ufffd\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\u003Eu\ufffd)vl\ufffdV _R\ufffd~sV\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd?\ufffd\ufffd9\ufffd\ufffd\ufffdi}\ufffd\ufffdH\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd_\ufffd\u0022, \u0022target_port_label\u0022: \u00226443 \u00b7 K8S API\u0022, \u0022emulator_service\u0022: \u0022k8s-api\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 5 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022k8s_api\u0022, \u0022service_banner\u0022: \u0022honeypot-k8s-api\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022k8s-api\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022k8s_api_emulated\u0022, \u0022k8s_api_payload\u0022, \u0022kubernetes_probe\u0022, \u0022net_kubernetes_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":6,"bytes_in":1483},{"id":10758486,"ip":"45.92.17.75","ts":"2026-10-30 15:13:37.000000","proto":"tcp","src_port":35478,"dst_port":8176,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022071e538011d9fb98dfbfabd6b099ae04\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 2, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 625, \u0022payload_entropy\u0022: 7.0175370850565955, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8176, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022429bf516d36b9b35f404bf0f25676e587ffb91df\u0022, \u0022event_fingerprint\u0022: \u0022f3f9d6134f7e30f346aa76cd17ed7ea0db02553f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022071e538011d9fb98dfbfabd6b099ae04\u0022, \u0022payload_hash\u0022: \u002287350c75624ba919968ec71c08ff4f1b\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8176, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002l\\u0001\\u0000\\u0002h\\u0003\\u0003g8z\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000F\ufffd\\u001a\ufffd?4\ufffd]\\f\\u0007\ufffd\\u000fu\ufffdD\ufffd.\ufffd\ufffd\\u000f\ufffdL\\u001e \\u0003S\ufffdk\ufffd:\u0287\ufffd\ufffdb\ufffd8\ufffdR\\u0019\ufffd\ufffd\ufffdK\\u0006jj\ufffd\ufffd~aNS\ufffd\\u001a\ufffd\\u0000 zz\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002l\\u0001\\u0000\\u0002h\\u0003\\u0003g8z\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000F\ufffd\\u001a\ufffd?4\ufffd]\\f\\u0007\ufffd\\u000fu\ufffdD\ufffd.\ufffd\ufffd\\u000f\ufffdL\\u001e \\u0003S\ufffdk\ufffd:\u0287\ufffd\ufffdb\ufffd8\ufffdR\\u0019\ufffd\ufffd\ufffdK\\u0006jj\ufffd\ufffd~aNS\ufffd\\u001a\ufffd\\u0000 zz\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\ufffd\\r\\u0001\\u001a\\u0000\\u0000\\u0001\\u0000\\u0001$\\u0000 \\u001a\\u000fu\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd$\ufffd\ufffdDg\\u0007^38y\\u0014\\u0011iw\\u0010d\\n_5\\\u0022\\u0004\\u0000\ufffd\ufffd\\u001c\ufffd\ufffd9 \\u001a\\u0007+\ufffdg9M\ufffd8\ufffd\ufffdja\ufffd\u0027\ufffd\ufffd\ufffd\ufffdoa_Z\ufffd\\\u0022\ufffd\ufffdU\ufffd\ufffd\ufffd[%\/\ufffd\ufffd\\u0004\ufffd\u079dS\ufffdT[\ufffdd\ufffdA\\u0006\\u0007{\ufffdZ\ufffdn\ufffd\ufffd\ufffd\ufffd\\r\ufffd\\u001e\ufffd=;\ufffd\ufffdO\u015b\ufffd)\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002l\\u0001\\u0000\\u0002h\\u0003\\u0003g8z\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000F\ufffd\\u001a\ufffd?4\ufffd]\\f\\u0007\ufffd\\u000fu\ufffdD\ufffd.\ufffd\ufffd\\u000f\ufffdL\\u001e \\u0003S\ufffdk\ufffd:\u0287\ufffd\ufffdb\ufffd8\ufffdR\\u0019\ufffd\ufffd\ufffdK\\u0006jj\ufffd\ufffd~aNS\ufffd\\u001a\ufffd\\u0000 zz\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002201c846dd2e040a8833ec9684aa5a8fa817e3edae\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002l\\u0001\\u0000\\u0002h\\u0003\\u0003g8z\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000F\ufffd\\u001a\ufffd?4\ufffd]\\f\\u0007\ufffd\\u000fu\ufffdD\ufffd.\ufffd\ufffd\\u000f\ufffdL\\u001e \\u0003S\ufffdk\ufffd:\u0287\ufffd\ufffdb\ufffd8\ufffdR\\u0019\ufffd\ufffd\ufffdK\\u0006jj\ufffd\ufffd~aNS\ufffd\\u001a\ufffd\\u0000 zz\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u0022071e538011d9fb98dfbfabd6b099ae04\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022port\u0022: 8176, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022lhg8z\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd?4\ufffd]\ufffdu\ufffdD\ufffd.\ufffd\ufffd\ufffdL S\ufffdk\ufffd:\u0287\ufffd\ufffdb\ufffd8\ufffdR\ufffd\ufffd\ufffdKjj\ufffd\ufffd~aNS\ufffd\ufffd zz\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8176 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228176 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8176, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002l\\u0001\\u0000\\u0002h\\u0003\\u0003g8z\ufffd\ufffd\ufffd\ufffd\ufffd\\u0000F\ufffd\\u001a\ufffd?4\ufffd]\\f\\u0007\ufffd\\u000fu\ufffdD\ufffd.\ufffd\ufffd\\u000f\ufffdL\\u001e \\u0003S\ufffdk\ufffd:\u0287\ufffd\ufffdb\ufffd8\ufffdR\\u0019\ufffd\ufffd\ufffdK\\u0006jj\ufffd\ufffd~aNS\ufffd\\u001a\ufffd\\u0000 zz\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u0022071e538011d9fb98dfbfabd6b099ae04\u0022, \u0022tls_sni\u0022: \u0022ip-62-3-50-33.v4.isp.servpersosystems.net\u0022, \u0022port\u0022: 8176, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8176 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022lhg8z\ufffd\ufffd\ufffd\ufffd\ufffdF\ufffd\ufffd?4\ufffd]\ufffdu\ufffdD\ufffd.\ufffd\ufffd\ufffdL S\ufffdk\ufffd:\u0287\ufffd\ufffdb\ufffd8\ufffdR\ufffd\ufffd\ufffdKjj\ufffd\ufffd~aNS\ufffd\ufffd zz\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228176 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228176\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":"ip-62-3-50-33.v4.isp.servpersosystems.net","tls_ja3_hash":"071e538011d9fb98dfbfabd6b099ae04","tls_ja3":"771,31354-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,60138-18-5-65037-11-13-10-16-65281-35-51-27-23-45-0-17513-43-19018,39578-29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":625},{"id":10757599,"ip":"45.92.17.75","ts":"2026-10-30 15:11:04.000000","proto":"tcp","src_port":45484,"dst_port":7348,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00222bc372eef758800abe3c5908c04c9dfb\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 2, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 511, \u0022payload_entropy\u0022: 6.88226256514784, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 7348, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e28f85eb9746d3f9b5d5af29f8291762b553aabc\u0022, \u0022event_fingerprint\u0022: \u00225a51771bc1c1d256d755b9d96c96fa3dde2726d9\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00222bc372eef758800abe3c5908c04c9dfb\u0022, \u0022payload_hash\u0022: \u00229dbc71ee7abdb4d408c40e1a1bb05fc2\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 7348, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003:\\f\\\\\ufffdK#\ufffd\u003C\u07a4\ufffd\ufffd\ufffd\ufffd7(B\ufffd\ufffd\ufffd\ufffd.\u0752\ufffd\u0444\ufffd\ufffd\ufffd\ufffdp \ufffd\\u000f\\u0013\\u0006z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd,\\u001b\ufffd2Q\ufffdk\ufffd\ufffdg\ufffdn\ufffd\ufffd\\u0004y\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdzz\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\b\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003:\\f\\\\\ufffdK#\ufffd\u003C\u07a4\ufffd\ufffd\ufffd\ufffd7(B\ufffd\ufffd\ufffd\ufffd.\u0752\ufffd\u0444\ufffd\ufffd\ufffd\ufffdp \ufffd\\u000f\\u0013\\u0006z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd,\\u001b\ufffd2Q\ufffdk\ufffd\ufffdg\ufffdn\ufffd\ufffd\\u0004y\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdzz\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\ufffd\\u0001\\u0000\\u0001\\u0000Di\\u0000\\u0005\\u0000\\u0003\\u0002h2\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000\\u001b\\u0000\\u0003\\u0002\\u0000\\u0002\\u0000\\n\\u0000\\n\\u0000\\bJJ\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000+\\u0000\\u0007\\u0006ZZ\\u0003\\u0004\\u0003\\u0003\ufffd\\r\\u0000\ufffd\\u0000\\u0000\\u0001\\u0000\\u0001\ufffd\\u0000 \\u0001\ufffd4u\ufffd{yo\ufffd\\u000f\\u0010\ufffdv\ufffd\ufffd\ufffd%\ufffd\\u000e\ufffd$M \ufffd$\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003:\\f\\\\\ufffdK#\ufffd\u003C\u07a4\ufffd\ufffd\ufffd\ufffd7(B\ufffd\ufffd\ufffd\ufffd.\u0752\ufffd\u0444\ufffd\ufffd\ufffd\ufffdp \ufffd\\u000f\\u0013\\u0006z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd,\\u001b\ufffd2Q\ufffdk\ufffd\ufffdg\ufffdn\ufffd\ufffd\\u0004y\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdzz\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ca0695c2756cce89b6a918c49294ab21caf22c3c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003:\\f\\\\\ufffdK#\ufffd\u003C\u07a4\ufffd\ufffd\ufffd\ufffd7(B\ufffd\ufffd\ufffd\ufffd.\u0752\ufffd\u0444\ufffd\ufffd\ufffd\ufffdp \ufffd\\u000f\\u0013\\u0006z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd,\\u001b\ufffd2Q\ufffdk\ufffd\ufffdg\ufffdn\ufffd\ufffd\\u0004y\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdzz\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\b\u0022, \u0022tls_ja3\u0022: \u00222bc372eef758800abe3c5908c04c9dfb\u0022, \u0022port\u0022: 7348, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd:\\\\\ufffdK#\ufffd\u003C\u07a4\ufffd\ufffd\ufffd\ufffd7(B\ufffd\ufffd\ufffd\ufffd.\u0752\ufffd\u0444\ufffd\ufffd\ufffd\ufffdp \ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd,\ufffd2Q\ufffdk\ufffd\ufffdg\ufffdn\ufffd\ufffdy \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdzzh2\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:7348 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00227348 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 7348, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003:\\f\\\\\ufffdK#\ufffd\u003C\u07a4\ufffd\ufffd\ufffd\ufffd7(B\ufffd\ufffd\ufffd\ufffd.\u0752\ufffd\u0444\ufffd\ufffd\ufffd\ufffdp \ufffd\\u000f\\u0013\\u0006z\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd,\\u001b\ufffd2Q\ufffdk\ufffd\ufffdg\ufffdn\ufffd\ufffd\\u0004y\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdzz\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\b\u0022, \u0022tls_ja3\u0022: \u00222bc372eef758800abe3c5908c04c9dfb\u0022, \u0022port\u0022: 7348, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:7348 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd:\\\\\ufffdK#\ufffd\u003C\u07a4\ufffd\ufffd\ufffd\ufffd7(B\ufffd\ufffd\ufffd\ufffd.\u0752\ufffd\u0444\ufffd\ufffd\ufffd\ufffdp \ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\ufffd\ufffd,\ufffd2Q\ufffdk\ufffd\ufffdg\ufffdn\ufffd\ufffdy \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdzzh2\u0022, \u0022target_port_label\u0022: \u00227348 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00227348\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"2bc372eef758800abe3c5908c04c9dfb","tls_ja3":"771,51914-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,31354-16-65281-17513-5-11-13-27-10-43-65037-18-23-45-35-51-2570,19018-29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":511},{"id":10756661,"ip":"45.92.17.75","ts":"2026-10-30 15:08:16.000000","proto":"tcp","src_port":22980,"dst_port":8176,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 1483, \u0022payload_entropy\u0022: 7.746429001978368, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8176, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022ad22227ea25d1f7b9d0be403d0c7d80e0f5e3676\u0022, \u0022event_fingerprint\u0022: \u0022998df0bea46f40e25b26f88da96fadc6a298b3b6\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022payload_hash\u0022: \u002268f7777c6ea331e11177743c356ea711\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8176, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffdODv\ufffd\ufffd\\t\ufffd\ufffd\ufffdV\ufffd\u041b\\u0007\u07b1\\u0010no\ufffdj\ufffd]\ufffd\\u001f\ufffd\ufffd9\ufffd\ufffd I\ufffd8f\ufffdV\\u0004\ufffd\ufffd\\u001a}\ufffd\ufffd\ufffd\ufffd\ufffd\/~\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffd[\ufffdB\ufffd\ufffd\ufffd:\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffdODv\ufffd\ufffd\\t\ufffd\ufffd\ufffdV\ufffd\u041b\\u0007\u07b1\\u0010no\ufffdj\ufffd]\ufffd\\u001f\ufffd\ufffd9\ufffd\ufffd I\ufffd8f\ufffdV\\u0004\ufffd\ufffd\\u001a}\ufffd\ufffd\ufffd\ufffd\ufffd\/~\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffd[\ufffdB\ufffd\ufffd\ufffd:\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u0016\\u0000\\u0014\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u00002\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\\u0003\\u0003\\u0002\\u0003\\u0001\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd\ufffd\ufffdZQ7\ufffd\\u0016[\ufffdF\ufffd;\ufffd\ufffd\\f\ufffd\ufffd\\u0018.\\u0015i\u01ecN\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffdODv\ufffd\ufffd\\t\ufffd\ufffd\ufffdV\ufffd\u041b\\u0007\u07b1\\u0010no\ufffdj\ufffd]\ufffd\\u001f\ufffd\ufffd9\ufffd\ufffd I\ufffd8f\ufffdV\\u0004\ufffd\ufffd\\u001a}\ufffd\ufffd\ufffd\ufffd\ufffd\/~\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffd[\ufffdB\ufffd\ufffd\ufffd:\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220ccdc78c2678483fcd7c21eaf91f77dd7cf584b4\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffdODv\ufffd\ufffd\\t\ufffd\ufffd\ufffdV\ufffd\u041b\\u0007\u07b1\\u0010no\ufffdj\ufffd]\ufffd\\u001f\ufffd\ufffd9\ufffd\ufffd I\ufffd8f\ufffdV\\u0004\ufffd\ufffd\\u001a}\ufffd\ufffd\ufffd\ufffd\ufffd\/~\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffd[\ufffdB\ufffd\ufffd\ufffd:\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022port\u0022: 8176, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdODv\ufffd\ufffd\\t\ufffd\ufffd\ufffdV\ufffd\u041b\u07b1no\ufffdj\ufffd]\ufffd\ufffd\ufffd9\ufffd\ufffd I\ufffd8f\ufffdV\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\/~\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffd[\ufffdB\ufffd\ufffd\ufffd:\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd_\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8176 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228176 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8176, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffdODv\ufffd\ufffd\\t\ufffd\ufffd\ufffdV\ufffd\u041b\\u0007\u07b1\\u0010no\ufffdj\ufffd]\ufffd\\u001f\ufffd\ufffd9\ufffd\ufffd I\ufffd8f\ufffdV\\u0004\ufffd\ufffd\\u001a}\ufffd\ufffd\ufffd\ufffd\ufffd\/~\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffd[\ufffdB\ufffd\ufffd\ufffd:\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022port\u0022: 8176, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8176 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdODv\ufffd\ufffd\\t\ufffd\ufffd\ufffdV\ufffd\u041b\u07b1no\ufffdj\ufffd]\ufffd\ufffd\ufffd9\ufffd\ufffd I\ufffd8f\ufffdV\ufffd\ufffd}\ufffd\ufffd\ufffd\ufffd\ufffd\/~\ufffd\ufffd\ufffd\ufffd\ufffd~\ufffd[\ufffdB\ufffd\ufffd\ufffd:\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd_\ufffd\u0022, \u0022target_port_label\u0022: \u00228176 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228176\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":1483},{"id":10708565,"ip":"45.92.17.75","ts":"2026-10-30 13:49:23.000000","proto":"tcp","src_port":55142,"dst_port":8178,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 1483, \u0022payload_entropy\u0022: 7.7169240731911195, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8178, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002217e7090a657607d8e108002209b2763dd183cf19\u0022, \u0022event_fingerprint\u0022: \u0022f2cfe66c78f0d4c3ed6a85a013c9f52c52ecc18f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022payload_hash\u0022: \u00225aacc83b403bd7ee8293b35fa1c93617\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8178, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdGp\ufffd+y\u0391\ufffd*\ufffdJ\ufffdfM\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdz+XN\\\u0022\ufffd\ufffd\ufffd ;\ufffd\ueb8d \\u00042A\\u000e\\u0006\ufffd\ufffd\\u0006\ufffd\ufffdR\u003Cy\\u0016n{\ufffd\\u0007\ufffdw\ufffd\ufffd\ufffd\\u0004\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdGp\ufffd+y\u0391\ufffd*\ufffdJ\ufffdfM\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdz+XN\\\u0022\ufffd\ufffd\ufffd ;\ufffd\ueb8d \\u00042A\\u000e\\u0006\ufffd\ufffd\\u0006\ufffd\ufffdR\u003Cy\\u0016n{\ufffd\\u0007\ufffdw\ufffd\ufffd\ufffd\\u0004\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u0016\\u0000\\u0014\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u00002\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\\u0003\\u0003\\u0002\\u0003\\u0001\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd4f0a\ufffd%a\\u001cY#{X\\u0014j\ufffd`I\ufffdA\ufffd\ufffd\\u0006\\u0001\\\u0022\\r\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdGp\ufffd+y\u0391\ufffd*\ufffdJ\ufffdfM\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdz+XN\\\u0022\ufffd\ufffd\ufffd ;\ufffd\ueb8d \\u00042A\\u000e\\u0006\ufffd\ufffd\\u0006\ufffd\ufffdR\u003Cy\\u0016n{\ufffd\\u0007\ufffdw\ufffd\ufffd\ufffd\\u0004\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fe4f549f4f7e960636fca6e627be5b8695c8d7f6\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdGp\ufffd+y\u0391\ufffd*\ufffdJ\ufffdfM\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdz+XN\\\u0022\ufffd\ufffd\ufffd ;\ufffd\ueb8d \\u00042A\\u000e\\u0006\ufffd\ufffd\\u0006\ufffd\ufffdR\u003Cy\\u0016n{\ufffd\\u0007\ufffdw\ufffd\ufffd\ufffd\\u0004\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022port\u0022: 8178, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdGp\ufffd+y\u0391\ufffd*\ufffdJ\ufffdfM\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdz+XN\\\u0022\ufffd\ufffd\ufffd ;\ufffd\ueb8d 2A\ufffd\ufffd\ufffd\ufffdR\u003Cyn{\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd_\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8178 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228178 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8178, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffdGp\ufffd+y\u0391\ufffd*\ufffdJ\ufffdfM\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdz+XN\\\u0022\ufffd\ufffd\ufffd ;\ufffd\ueb8d \\u00042A\\u000e\\u0006\ufffd\ufffd\\u0006\ufffd\ufffdR\u003Cy\\u0016n{\ufffd\\u0007\ufffdw\ufffd\ufffd\ufffd\\u0004\ufffd\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022port\u0022: 8178, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8178 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdGp\ufffd+y\u0391\ufffd*\ufffdJ\ufffdfM\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd\ufffdz+XN\\\u0022\ufffd\ufffd\ufffd ;\ufffd\ueb8d 2A\ufffd\ufffd\ufffd\ufffdR\u003Cyn{\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd_\ufffd\u0022, \u0022target_port_label\u0022: \u00228178 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228178\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":1483},{"id":10695528,"ip":"45.92.17.75","ts":"2026-10-30 13:09:28.000000","proto":"tcp","src_port":34190,"dst_port":8117,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 542, \u0022payload_entropy\u0022: 4.161650730260368, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8117, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022ddc0a9ae8fa7e53ca21ece3f9265ff160a84fe43\u0022, \u0022event_fingerprint\u0022: \u002239d09fa72acde01463478cc3ecb8264b5a18312c\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44, \u0022correlation_boost\u0022: 8}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224509eec7340acca41e94bc6bae32c197\u0022, \u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8117, \u0022risk_score\u0022: 44}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000\\u0012\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0010sH\\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\\u0014\\u001d\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227336b19eacc932d507619d36ff7dee6e09398027\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 8117}, \u0022evidence_snippet\u0022: \u0022\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 8117 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228117\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 8117, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 8117}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 8117 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228117\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228117\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022port:8117\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":542},{"id":10695129,"ip":"45.92.17.75","ts":"2026-10-30 13:08:11.000000","proto":"tcp","src_port":41498,"dst_port":9205,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022tls_sni\u0022: null, \u0022bytes_in\u0022: 1483, \u0022payload_entropy\u0022: 7.7211478680312435, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 9205, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022c55a2e2e6c259793d9fb401ae5056f3e50e5c5a3\u0022, \u0022event_fingerprint\u0022: \u0022fa290fce703015400501c68c57861026fbcd5b3c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022payload_hash\u0022: \u00227b3a3ea15af751db53f39e0aaefe627f\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9205, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003Ml\\\\F\ufffd\ufffd\u07f8D\ufffd*\ufffd\ufffd\ufffd\\r\\u001eLg\ufffd\ufffd\ufffd\ufffdy\ufffd9UU\ufffd\u42b8 V\ufffd\ufffd\ufffd\u0266\ua447Q\ufffdR\ufffdf+_\ufffd\ufffd\ufffd\ufffd9\\u0011\u0026\ufffdHI\ufffdy\\u0005*\\u0017\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003Ml\\\\F\ufffd\ufffd\u07f8D\ufffd*\ufffd\ufffd\ufffd\\r\\u001eLg\ufffd\ufffd\ufffd\ufffdy\ufffd9UU\ufffd\u42b8 V\ufffd\ufffd\ufffd\u0266\ua447Q\ufffdR\ufffdf+_\ufffd\ufffd\ufffd\ufffd9\\u0011\u0026\ufffdHI\ufffdy\\u0005*\\u0017\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u0016\\u0000\\u0014\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u00002\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\\u0003\\u0003\\u0002\\u0003\\u0001\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd\\\\\ufffd\\u0015Q\ufffd\ufffd~P\\t9\u067cz\u02f2\ufffd\ufffd\ufffd7\ufffdS\ufffd\ufffd\ufffdT\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003Ml\\\\F\ufffd\ufffd\u07f8D\ufffd*\ufffd\ufffd\ufffd\\r\\u001eLg\ufffd\ufffd\ufffd\ufffdy\ufffd9UU\ufffd\u42b8 V\ufffd\ufffd\ufffd\u0266\ua447Q\ufffdR\ufffdf+_\ufffd\ufffd\ufffd\ufffd9\\u0011\u0026\ufffdHI\ufffdy\\u0005*\\u0017\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227f9e006c565c6dac977f31042bcfb006466fbd79\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003Ml\\\\F\ufffd\ufffd\u07f8D\ufffd*\ufffd\ufffd\ufffd\\r\\u001eLg\ufffd\ufffd\ufffd\ufffdy\ufffd9UU\ufffd\u42b8 V\ufffd\ufffd\ufffd\u0266\ua447Q\ufffdR\ufffdf+_\ufffd\ufffd\ufffd\ufffd9\\u0011\u0026\ufffdHI\ufffdy\\u0005*\\u0017\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022port\u0022: 9205, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdMl\\\\F\ufffd\ufffd\u07f8D\ufffd*\ufffd\ufffd\ufffd\\rLg\ufffd\ufffd\ufffd\ufffdy\ufffd9UU\ufffd\u42b8 V\ufffd\ufffd\ufffd\u0266\ua447Q\ufffdR\ufffdf+_\ufffd\ufffd\ufffd\ufffd9\u0026\ufffdHI\ufffdy*\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd_\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:9205 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00229205 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 9205, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003Ml\\\\F\ufffd\ufffd\u07f8D\ufffd*\ufffd\ufffd\ufffd\\r\\u001eLg\ufffd\ufffd\ufffd\ufffdy\ufffd9UU\ufffd\u42b8 V\ufffd\ufffd\ufffd\u0266\ua447Q\ufffdR\ufffdf+_\ufffd\ufffd\ufffd\ufffd9\\u0011\u0026\ufffdHI\ufffdy\\u0005*\\u0017\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005_\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u00222196848d251b217de8b2c037e356c11d\u0022, \u0022port\u0022: 9205, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:9205 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdMl\\\\F\ufffd\ufffd\u07f8D\ufffd*\ufffd\ufffd\ufffd\\rLg\ufffd\ufffd\ufffd\ufffdy\ufffd9UU\ufffd\u42b8 V\ufffd\ufffd\ufffd\u0266\ua447Q\ufffdR\ufffdf+_\ufffd\ufffd\ufffd\ufffd9\u0026\ufffdHI\ufffdy*\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffd_\ufffd\u0022, \u0022target_port_label\u0022: \u00229205 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229205\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]}","tls_sni":null,"tls_ja3_hash":"2196848d251b217de8b2c037e356c11d","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022]","anomalies":"[]","severity":2,"bytes_in":1483},{"id":10694807,"ip":"45.92.17.75","ts":"2026-10-30 13:07:12.000000","proto":"tcp","src_port":58606,"dst_port":8117,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u00220806eed8803a68eaefd620b4e142616a\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 2, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 543, \u0022payload_entropy\u0022: 6.936732007297772, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8117, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 5.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222ef9502749535b064304754a47b56869e1ca653b\u0022, \u0022event_fingerprint\u0022: \u0022aa47139bd1fd70fcb9c01547a3cd4d02f8de1c6f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u00220806eed8803a68eaefd620b4e142616a\u0022, \u0022payload_hash\u0022: \u0022041a6da9aa55038f1e858311df983ede\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8117, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u001a\\u0001\\u0000\\u0002\\u0016\\u0003\\u0003x\ufffd\ufffd\ufffdppP\ufffd\ufffdH\ufffd\ufffd\ufffd\\u001c\ufffd)7\ufffd\\u001f\ufffd\ufffdT:\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffdt \ufffd\ufffd\ufffd\\u0012\\u0016`?\ufffd\ufffde\ufffd\\u0001\ufffd\ufffd\ufffdb\ufffdQ\ufffd\ufffd\ufffd0W\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdjj\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\\u0001\\u0000\\u0001\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u001a\\u0001\\u0000\\u0002\\u0016\\u0003\\u0003x\ufffd\ufffd\ufffdppP\ufffd\ufffdH\ufffd\ufffd\ufffd\\u001c\ufffd)7\ufffd\\u001f\ufffd\ufffdT:\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffdt \ufffd\ufffd\ufffd\\u0012\\u0016`?\ufffd\ufffde\ufffd\\u0001\ufffd\ufffd\ufffdb\ufffdQ\ufffd\ufffd\ufffd0W\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdjj\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\\u0001\\u0000\\u0001\ufffd\\u0000 \\u0002\\u0003\ufffd\\u001aQ\\u0019.\u00ba\ufffd\ufffd\\u0005\ufffd\ufffd\ufffdHZsw\ufffd\ufffd\ufffdj\ufffd\ufffd`C\ufffd\ufffd%\ufffd\\u0017\\u0000\u040dm\ufffd}\u0462o\ufffd\ufffdK\\u001a\\u0014\\\\\ufffd\ufffd\ufffd87j\\u0017\ufffd\ufffd\\u001c\u05e9\\u001eQ\ufffd\\u0013$\ufffd\ufffd\\u0018A\ufffdAY[\u0027NX\ufffd\ufffdBA,n\ufffd\\\\\ufffdBs\\b\ufffdk\ufffd\ufffd[=\ufffdq\ufffd|%\\u0002\ufffd\ufffd\ufffd\ufffd\ufffd\u0027\ufffd\ufffdk\ufffd\\u0001\\u0016\\u001bQ\ufffd\ufffd\\u0000\\u0012-Gg\u7e04j\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u001a\\u0001\\u0000\\u0002\\u0016\\u0003\\u0003x\ufffd\ufffd\ufffdppP\ufffd\ufffdH\ufffd\ufffd\ufffd\\u001c\ufffd)7\ufffd\\u001f\ufffd\ufffdT:\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffdt \ufffd\ufffd\ufffd\\u0012\\u0016`?\ufffd\ufffde\ufffd\\u0001\ufffd\ufffd\ufffdb\ufffdQ\ufffd\ufffd\ufffd0W\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdjj\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\\u0001\\u0000\\u0001\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00229d1d7f9ff86f066cf23a2f0a4c27bd23bdfcacb8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u001a\\u0001\\u0000\\u0002\\u0016\\u0003\\u0003x\ufffd\ufffd\ufffdppP\ufffd\ufffdH\ufffd\ufffd\ufffd\\u001c\ufffd)7\ufffd\\u001f\ufffd\ufffdT:\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffdt \ufffd\ufffd\ufffd\\u0012\\u0016`?\ufffd\ufffde\ufffd\\u0001\ufffd\ufffd\ufffdb\ufffdQ\ufffd\ufffd\ufffd0W\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdjj\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\\u0001\\u0000\\u0001\ufffd\u0022, \u0022tls_ja3\u0022: \u00220806eed8803a68eaefd620b4e142616a\u0022, \u0022port\u0022: 8117, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022x\ufffd\ufffd\ufffdppP\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd)7\ufffd\ufffd\ufffdT:\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffdt \ufffd\ufffd\ufffd`?\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdb\ufffdQ\ufffd\ufffd\ufffd0W\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdjj\ufffd\\r\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8117 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228117 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 8117, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u001a\\u0001\\u0000\\u0002\\u0016\\u0003\\u0003x\ufffd\ufffd\ufffdppP\ufffd\ufffdH\ufffd\ufffd\ufffd\\u001c\ufffd)7\ufffd\\u001f\ufffd\ufffdT:\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffdt \ufffd\ufffd\ufffd\\u0012\\u0016`?\ufffd\ufffde\ufffd\\u0001\ufffd\ufffd\ufffdb\ufffdQ\ufffd\ufffd\ufffd0W\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffdjj\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\\u0001\\u0000\\u0001\ufffd\u0022, \u0022tls_ja3\u0022: \u00220806eed8803a68eaefd620b4e142616a\u0022, \u0022port\u0022: 8117, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:8117 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022x\ufffd\ufffd\ufffdppP\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd)7\ufffd\ufffd\ufffdT:\ufffd\ufffd\ufffd\ufffdx\ufffd\ufffdt \ufffd\ufffd\ufffd`?\ufffd\ufffde\ufffd\ufffd\ufffd\ufffdb\ufffdQ\ufffd\ufffd\ufffd0W\ufffd\ufffd\ufffd\ufffd\ufffd:\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdjj\ufffd\\r\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228117 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228117\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"0806eed8803a68eaefd620b4e142616a","tls_ja3":"771,35466-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27242-65037-17513-51-11-23-10-45-5-16-65281-35-18-13-27-43-60138,14906-29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":543},{"id":10684845,"ip":"45.92.17.75","ts":"2026-10-30 12:36:34.000000","proto":"tcp","src_port":22024,"dst_port":18108,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022e8402c989e3d78dbb99183feda2368a8\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 2, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 511, \u0022payload_entropy\u0022: 6.8751430107014295, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 18108, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 1.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002232f7642e2c526dedded8781495eb11af3c65422e\u0022, \u0022event_fingerprint\u0022: \u0022e29020c0c3abac1d726e1b844298bb6f1a361991\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022e8402c989e3d78dbb99183feda2368a8\u0022, \u0022payload_hash\u0022: \u00221a000eaf25cba6cbed1795c2109c4dd4\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 18108, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S[!\ufffd\ufffd^:`[\ufffd\ufffd\ufffdW-d\ufffd\ufffdi)\ufffd\ufffdm3r\ufffd\ufffd\ufffdb\ufffdB\ufffd \\u0007\ufffdRM\ufffd\ufffd,\\f\ufffd\ufffdw\ufffd\ufffd\\u0014E\u0027\ufffdH\ufffd\ufffdb%a\\u001d\ufffd\ufffd|\ufffd\u0439\u0027+\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S[!\ufffd\ufffd^:`[\ufffd\ufffd\ufffdW-d\ufffd\ufffdi)\ufffd\ufffdm3r\ufffd\ufffd\ufffdb\ufffdB\ufffd \\u0007\ufffdRM\ufffd\ufffd,\\f\ufffd\ufffdw\ufffd\ufffd\\u0014E\u0027\ufffdH\ufffd\ufffdb%a\\u001d\ufffd\ufffd|\ufffd\u0439\u0027+\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\\u0001\\u0000\\u00012\\u0000 ^\ufffd6\ufffd\ufffd\ufffdfQ\ufffdW,0\ufffd\u0659^\ufffd\ufffdo\ufffd.r\ufffd\ufffdWG`\ufffd\ufffd\\u0012\ufffd\\f\\u0000\ufffdm\\u0010\u145f\ufffd48\ufffd\ufffdl\ufffd\ufffdT\ufffd\ufffd\ufffd\\u0016Go\u003C\ufffdMw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\u07afe\ufffd:\\u0011\ufffd\ufffd\ufffd\ufffd\\ts.\u0027\\u0012\ufffd3%\ud7c5G\ufffd~\ufffd?\\f\\u001b+=\ufffd\ufffdz\ufffd\ufffd\\u0017d\ufffds\ufffd\ufffd\ufffd\\u0001\u0026\ufffdK\ufffd\ufffdGd\u02ecP\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S[!\ufffd\ufffd^:`[\ufffd\ufffd\ufffdW-d\ufffd\ufffdi)\ufffd\ufffdm3r\ufffd\ufffd\ufffdb\ufffdB\ufffd \\u0007\ufffdRM\ufffd\ufffd,\\f\ufffd\ufffdw\ufffd\ufffd\\u0014E\u0027\ufffdH\ufffd\ufffdb%a\\u001d\ufffd\ufffd|\ufffd\u0439\u0027+\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S[!\ufffd\ufffd^:`[\ufffd\ufffd\ufffdW-d\ufffd\ufffdi)\ufffd\ufffdm3r\ufffd\ufffd\ufffdb\ufffdB\ufffd \\u0007\ufffdRM\ufffd\ufffd,\\f\ufffd\ufffdw\ufffd\ufffd\\u0014E\u0027\ufffdH\ufffd\ufffdb%a\\u001d\ufffd\ufffd|\ufffd\u0439\u0027+\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\\u0001\\u0000\\u00012\\u0000 ^\ufffd6\ufffd\ufffd\ufffdfQ\ufffdW,0\ufffd\u0659^\ufffd\ufffdo\ufffd.r\ufffd\ufffdWG`\ufffd\ufffd\\u0012\ufffd\\f\\u0000\ufffdm\\u0010\u145f\ufffd48\ufffd\ufffdl\ufffd\ufffdT\ufffd\ufffd\ufffd\\u0016Go\u003C\ufffdMw\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\u07afe\ufffd:\\u0011\ufffd\ufffd\ufffd\ufffd\\ts.\u0027\\u0012\ufffd3%\ud7c5G\ufffd~\ufffd?\\f\\u001b+=\ufffd\ufffdz\ufffd\ufffd\\u0017d\ufffds\ufffd\ufffd\ufffd\\u0001\u0026\ufffdK\ufffd\ufffdGd\u02ecP\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S[!\ufffd\ufffd^:`[\ufffd\ufffd\ufffdW-d\ufffd\ufffdi)\ufffd\ufffdm3r\ufffd\ufffd\ufffdb\ufffdB\ufffd \\u0007\ufffdRM\ufffd\ufffd,\\f\ufffd\ufffdw\ufffd\ufffd\\u0014E\u0027\ufffdH\ufffd\ufffdb%a\\u001d\ufffd\ufffd|\ufffd\u0439\u0027+\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022af7a021e1eb0f8d61a3c36eb1b74b6ac2c08471b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S[!\ufffd\ufffd^:`[\ufffd\ufffd\ufffdW-d\ufffd\ufffdi)\ufffd\ufffdm3r\ufffd\ufffd\ufffdb\ufffdB\ufffd \\u0007\ufffdRM\ufffd\ufffd,\\f\ufffd\ufffdw\ufffd\ufffd\\u0014E\u0027\ufffdH\ufffd\ufffdb%a\\u001d\ufffd\ufffd|\ufffd\u0439\u0027+\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022e8402c989e3d78dbb99183feda2368a8\u0022, \u0022port\u0022: 18108, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdS[!\ufffd\ufffd^:`[\ufffd\ufffd\ufffdW-d\ufffd\ufffdi)\ufffd\ufffdm3r\ufffd\ufffd\ufffdb\ufffdB\ufffd \ufffdRM\ufffd\ufffd,\ufffd\ufffdw\ufffd\ufffdE\u0027\ufffdH\ufffd\ufffdb%a\ufffd\ufffd|\ufffd\u0439\u0027+ \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd\\r\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:18108 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002218108 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 18108, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003S[!\ufffd\ufffd^:`[\ufffd\ufffd\ufffdW-d\ufffd\ufffdi)\ufffd\ufffdm3r\ufffd\ufffd\ufffdb\ufffdB\ufffd \\u0007\ufffdRM\ufffd\ufffd,\\f\ufffd\ufffdw\ufffd\ufffd\\u0014E\u0027\ufffdH\ufffd\ufffdb%a\\u001d\ufffd\ufffd|\ufffd\u0439\u0027+\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\ufffd\ufffd\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\r\\u0000\ufffd\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022e8402c989e3d78dbb99183feda2368a8\u0022, \u0022port\u0022: 18108, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:18108 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdS[!\ufffd\ufffd^:`[\ufffd\ufffd\ufffdW-d\ufffd\ufffdi)\ufffd\ufffdm3r\ufffd\ufffd\ufffdb\ufffdB\ufffd \ufffdRM\ufffd\ufffd,\ufffd\ufffdw\ufffd\ufffdE\u0027\ufffdH\ufffd\ufffdb%a\ufffd\ufffd|\ufffd\u0439\u0027+ \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd\\r\ufffd\u0022, \u0022target_port_label\u0022: \u002218108 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002218108\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"e8402c989e3d78dbb99183feda2368a8","tls_ja3":"771,43690-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35466-18-65037-27-5-17513-35-65281-43-23-10-13-11-51-45-16-10794,47802-29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":511},{"id":10659262,"ip":"45.92.17.75","ts":"2026-10-30 11:18:00.000000","proto":"tcp","src_port":49634,"dst_port":10216,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022a4a4c43b25da48c66200ca1a40957d85\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 2, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 511, \u0022payload_entropy\u0022: 6.864513492193414, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 10216, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022faa2da769c89874b3c76f22f625aa20d83cf6c8e\u0022, \u0022event_fingerprint\u0022: \u0022dae0a062915564215f8f2017ee9d9cfaa16a197d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.08, \u0022classification_confidence\u0022: 0.08, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022a4a4c43b25da48c66200ca1a40957d85\u0022, \u0022payload_hash\u0022: \u0022035c3be5c48fd19def1f3674f15399b5\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10216, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003w\ufffd\ufffd\\u0002!\\u001b\ufffd~\ufffdo\ufffd\\u0014\ufffdS4.\\u0017\u8ca1\u05b3L\ufffd\u003C]6\ufffd0\ufffd\ufffdZ \\u0013\ufffd\ufffd\\u0018\ufffd@j\ufffd\\u0002\ufffd\\u0004\ufffdu\\u0001$t\ufffd\ufffdr\ufffd\ufffd\\u000f\ufffd\\u0015\ufffd\ufffd\ufffd\u0026w\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003w\ufffd\ufffd\\u0002!\\u001b\ufffd~\ufffdo\ufffd\\u0014\ufffdS4.\\u0017\u8ca1\u05b3L\ufffd\u003C]6\ufffd0\ufffd\ufffdZ \\u0013\ufffd\ufffd\\u0018\ufffd@j\ufffd\\u0002\ufffd\\u0004\ufffdu\\u0001$t\ufffd\ufffdr\ufffd\ufffd\\u000f\ufffd\\u0015\ufffd\ufffd\ufffd\u0026w\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\n\\u0000\\b::\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\ufffd\\r\\u0000\ufffd\\u0000\\u0000\\u0001\\u0000\\u0001\ufffd\\u0000 $\ufffdP\ufffd\ufffd\ufffdX\ufffd\ufffdW\ufffd\ufffd*hc\ufffd\ufffd\\u0005\ufffd\\u0005\ufffd\\\u0022c\ufffdLW\ufffd\ufffd\ufffd\ufffdoG\\u0000\ufffdi\/\ufffd\ufffd\ufffd\ufffd4\ufffd8\\u001f\u00a7\ufffd3\ufffdJ\ufffd\ufffd\ufffd1\ufffd\ufffd\\r\u0026\ufffd\ufffd\u02d9\ufffd\ufffdVip+\ufffd\ufffd\ufffd%(\\u001eT[Th\\u0011\ufffd\ufffd\ufffd!\/\ufffd\\u0014tH\\u0019\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd\\u0017\ufffd\ufffd\ufffd?\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003w\ufffd\ufffd\\u0002!\\u001b\ufffd~\ufffdo\ufffd\\u0014\ufffdS4.\\u0017\u8ca1\u05b3L\ufffd\u003C]6\ufffd0\ufffd\ufffdZ \\u0013\ufffd\ufffd\\u0018\ufffd@j\ufffd\\u0002\ufffd\\u0004\ufffdu\\u0001$t\ufffd\ufffdr\ufffd\ufffd\\u000f\ufffd\\u0015\ufffd\ufffd\ufffd\u0026w\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224f7feb3997d4039062b90a46e8e9354ef0c22f88\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003w\ufffd\ufffd\\u0002!\\u001b\ufffd~\ufffdo\ufffd\\u0014\ufffdS4.\\u0017\u8ca1\u05b3L\ufffd\u003C]6\ufffd0\ufffd\ufffdZ \\u0013\ufffd\ufffd\\u0018\ufffd@j\ufffd\\u0002\ufffd\\u0004\ufffdu\\u0001$t\ufffd\ufffdr\ufffd\ufffd\\u000f\ufffd\\u0015\ufffd\ufffd\ufffd\u0026w\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022a4a4c43b25da48c66200ca1a40957d85\u0022, \u0022port\u0022: 10216, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdw\ufffd\ufffd!\ufffd~\ufffdo\ufffd\ufffdS4.\u8ca1\u05b3L\ufffd\u003C]6\ufffd0\ufffd\ufffdZ \ufffd\ufffd\ufffd@j\ufffd\ufffd\ufffdu$t\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0026w \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:10216 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002210216 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 8, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 10216, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003w\ufffd\ufffd\\u0002!\\u001b\ufffd~\ufffdo\ufffd\\u0014\ufffdS4.\\u0017\u8ca1\u05b3L\ufffd\u003C]6\ufffd0\ufffd\ufffdZ \\u0013\ufffd\ufffd\\u0018\ufffd@j\ufffd\\u0002\ufffd\\u0004\ufffdu\\u0001$t\ufffd\ufffdr\ufffd\ufffd\\u000f\ufffd\\u0015\ufffd\ufffd\ufffd\u0026w\\u0000 \ufffd\ufffd\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd::\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022a4a4c43b25da48c66200ca1a40957d85\u0022, \u0022port\u0022: 10216, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:10216 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdw\ufffd\ufffd!\ufffd~\ufffdo\ufffd\ufffdS4.\u8ca1\u05b3L\ufffd\u003C]6\ufffd0\ufffd\ufffdZ \ufffd\ufffd\ufffd@j\ufffd\ufffd\ufffdu$t\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0026w \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::\ufffd\u0022, \u0022target_port_label\u0022: \u002210216 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210216\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022port:10216\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"a4a4c43b25da48c66200ca1a40957d85","tls_ja3":"771,56026-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,14906-18-65281-10-65037-43-5-11-17513-23-51-16-13-27-45-35-10794,14906-29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":511},{"id":10659203,"ip":"45.92.17.75","ts":"2026-10-30 11:17:48.000000","proto":"tcp","src_port":22472,"dst_port":10216,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 501, \u0022payload_entropy\u0022: 3.7940870380940184, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 10216, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002278160f5c68386654253cba79624e8159dffde36c\u0022, \u0022event_fingerprint\u0022: \u0022f0f1e299d66106a84cfb69f751bd41553384c71c\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44, \u0022correlation_boost\u0022: 8}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002229b5329f45e73a6677bca0caf0ca278c\u0022, \u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10216, \u0022risk_score\u0022: 44}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000\\u0012\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0010sH\\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\\u0014\\u001d\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002205a49ec5507c25fb86e1972873747804be934b90\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 10216}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 10216 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002210216\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 10216, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0001\ufffd\\u0001\\u0000\\u0001\ufffd\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 10216}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 10216 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u002210216\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210216\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022port:10216\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":501},{"id":10659184,"ip":"45.92.17.75","ts":"2026-10-30 11:17:43.000000","proto":"tcp","src_port":8592,"dst_port":10216,"service":null,"classification":"port_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 542, \u0022payload_entropy\u0022: 4.161650730260368, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 10216, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002278160f5c68386654253cba79624e8159dffde36c\u0022, \u0022event_fingerprint\u0022: \u0022f0f1e299d66106a84cfb69f751bd41553384c71c\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44, \u0022correlation_boost\u0022: 8}, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224509eec7340acca41e94bc6bae32c197\u0022, \u0022path_pattern_hash\u0022: \u002249ebffbc8eed300cf9429db1ba4cf66d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10216, \u0022risk_score\u0022: 44}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\\u0003\\b\\u0004\\u0004\\u0001\\u0005\\u0003\\b\\u0005\\u0005\\u0001\\b\\u0006\\u0006\\u0001\\u0000\\u0012\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0010sH\\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\\u0014\\u001d\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226896cacf7ac5ad2c9ccb0e92404df1e91ad17950\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 10216}, \u0022evidence_snippet\u0022: \u0022\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 10216 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002210216\u0022, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 44\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 44, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 10216, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-FP-port-probe-noise\u0022, \u0022INT-single-port\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Fp Port Probe Noise\u0022, \u0022Single Port\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0001\\u0001\\u0002\\u0019\\u0001\\u0000\\u0002\\u0015\\u0001\\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\\u001d\u0253% 5\ufffdOET\\u0000\u045d\\u0018\\r|Ufj\ufffd]\\u0015(S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\u0002\\u0000\\\u0022\\u0013\\u0003\\u0013\\u0001\\u0013\\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\\u0013\ufffd\\u0014\ufffd\\u0013\ufffdS\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\u0000\\u0017\\u0000\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\n\\u0000\u0022, \u0022port\u0022: 10216}, \u0022attack_vector\u0022: \u0022Sonde port \u00b7 port 10216 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\\r|Ufj\ufffd](S\ufffd)f\ufffd\u003C\\rR%\ufffd\ufffd\u0027_\\\u0022\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u002210216\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210216\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022port:10216\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":542},{"id":10659119,"ip":"45.92.17.75","ts":"2026-10-30 11:17:31.000000","proto":"tcp","src_port":48140,"dst_port":10216,"service":"tls","classification":"tls","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u002220b279993ae2e137e62b9647c6d768fb\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022, \u0022bytes_in\u0022: 1507, \u0022payload_entropy\u0022: 7.720814987638205, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 10216, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022ce709e803e1f337271145c8165f3b7f8d5890f06\u0022, \u0022event_fingerprint\u0022: \u0022d613a3fa521baf96618aeac5ce47bdd73f3f128b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u002220b279993ae2e137e62b9647c6d768fb\u0022, \u0022payload_hash\u0022: \u0022a723a2e7415f44b6d25c1a3e2c77eea8\u0022, \u0022path_pattern_hash\u0022: \u0022b7e651cbb43ba0ca3498759c8c3596c3\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10216, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 0}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\\u0019\ufffd\ufffd1\\u0003\ufffd={\ufffdm\/\ufffd\ufffd\ufffd\u016a\ufffd=\ufffd\\u0001H\ufffd\\u0016A\ufffd@$\ufffdf\ufffd \ufffd\ufffd(\\n\ufffd2\ufffd\ufffd\ufffd\udbea\udec8W\ufffdi\\n\ufffd\ufffd\u0026\ufffd{v\\u001fW\\u001f\\u0003\ufffd\\u0018\ufffdm\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005w\\u0000\\u0000\\u0000\\u0014\\u0000\\u0012\\u0000\\u0000\\u000fblacklistip\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\\u0019\ufffd\ufffd1\\u0003\ufffd={\ufffdm\/\ufffd\ufffd\ufffd\u016a\ufffd=\ufffd\\u0001H\ufffd\\u0016A\ufffd@$\ufffdf\ufffd \ufffd\ufffd(\\n\ufffd2\ufffd\ufffd\ufffd\udbea\udec8W\ufffdi\\n\ufffd\ufffd\u0026\ufffd{v\\u001fW\\u001f\\u0003\ufffd\\u0018\ufffdm\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005w\\u0000\\u0000\\u0000\\u0014\\u0000\\u0012\\u0000\\u0000\\u000fblacklistip.com\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\ufffd\\u0001\\u0000\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\f\\u0000\\n\\u0011\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0019\\u0000\\r\\u0000\\u0016\\u0000\\u0014\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u00002\\u0000\\u001a\\u0000\\u0018\\b\\u0004\\u0004\\u0003\\b\\u0007\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0005\\u0003\\u0006\\u0003\\u0002\\u0001\\u0002\\u0003\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\\u0003\\u0003\\u0002\\u0003\\u0001\\u00003\\u0004\ufffd\\u0004\ufffd\\u0011\ufffd\\u0004\ufffd\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\\u0019\ufffd\ufffd1\\u0003\ufffd={\ufffdm\/\ufffd\ufffd\ufffd\u016a\ufffd=\ufffd\\u0001H\ufffd\\u0016A\ufffd@$\ufffdf\ufffd \ufffd\ufffd(\\n\ufffd2\ufffd\ufffd\ufffd\udbea\udec8W\ufffdi\\n\ufffd\ufffd\u0026\ufffd{v\\u001fW\\u001f\\u0003\ufffd\\u0018\ufffdm\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005w\\u0000\\u0000\\u0000\\u0014\\u0000\\u0012\\u0000\\u0000\\u000fblacklistip\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223bec16b09fea0a97424730ab13e795c7ead4de10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\\u0019\ufffd\ufffd1\\u0003\ufffd={\ufffdm\/\ufffd\ufffd\ufffd\u016a\ufffd=\ufffd\\u0001H\ufffd\\u0016A\ufffd@$\ufffdf\ufffd \ufffd\ufffd(\\n\ufffd2\ufffd\ufffd\ufffd\udbea\udec8W\ufffdi\\n\ufffd\ufffd\u0026\ufffd{v\\u001fW\\u001f\\u0003\ufffd\\u0018\ufffdm\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005w\\u0000\\u0000\\u0000\\u0014\\u0000\\u0012\\u0000\\u0000\\u000fblacklistip\u0022, \u0022tls_ja3\u0022: \u002220b279993ae2e137e62b9647c6d768fb\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022, \u0022port\u0022: 10216, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd={\ufffdm\/\ufffd\ufffd\ufffd\u016a\ufffd=\ufffdH\ufffdA\ufffd@$\ufffdf\ufffd \ufffd\ufffd(\\n\ufffd2\ufffd\ufffd\ufffd\udbea\udec8W\ufffdi\\n\ufffd\ufffd\u0026\ufffd{vW\ufffd\ufffdm\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffdwblacklistip\u0022, \u0022attack_vector\u0022: \u0022tls \u00b7 via TLS:10216 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002210216 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 10216, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0005\ufffd\\u0001\\u0000\\u0005\ufffd\\u0003\\u0003\ufffd\ufffd\\u0019\ufffd\ufffd1\\u0003\ufffd={\ufffdm\/\ufffd\ufffd\ufffd\u016a\ufffd=\ufffd\\u0001H\ufffd\\u0016A\ufffd@$\ufffdf\ufffd \ufffd\ufffd(\\n\ufffd2\ufffd\ufffd\ufffd\udbea\udec8W\ufffdi\\n\ufffd\ufffd\u0026\ufffd{v\\u001fW\\u001f\\u0003\ufffd\\u0018\ufffdm\ufffd\\u0000\\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\\u0013\ufffd\\n\ufffd\\u0014\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\\u0001\\u0000\\u0005w\\u0000\\u0000\\u0000\\u0014\\u0000\\u0012\\u0000\\u0000\\u000fblacklistip\u0022, \u0022tls_ja3\u0022: \u002220b279993ae2e137e62b9647c6d768fb\u0022, \u0022tls_sni\u0022: \u0022blacklistip.com\u0022, \u0022port\u0022: 10216, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls \u00b7 via TLS:10216 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffd={\ufffdm\/\ufffd\ufffd\ufffd\u016a\ufffd=\ufffdH\ufffdA\ufffd@$\ufffdf\ufffd \ufffd\ufffd(\\n\ufffd2\ufffd\ufffd\ufffd\udbea\udec8W\ufffdi\\n\ufffd\ufffd\u0026\ufffd{vW\ufffd\ufffdm\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\t\ufffd\ufffd\\n\ufffdwblacklistip\u0022, \u0022target_port_label\u0022: \u002210216 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210216\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022]}","tls_sni":"blacklistip.com","tls_ja3_hash":"20b279993ae2e137e62b9647c6d768fb","tls_ja3":"771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022]","anomalies":"[]","severity":0,"bytes_in":1507},{"id":10656878,"ip":"45.92.17.75","ts":"2026-10-30 11:10:22.000000","proto":"tcp","src_port":55026,"dst_port":15800,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022f89ea94ae2dff86045a6e3e343e61922\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 2, \u0022tls_alpn\u0022: [\u0022h2\u0022, \u0022http\/1.1\u0022], \u0022bytes_in\u0022: 575, \u0022payload_entropy\u0022: 6.9767450194222835, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 6206, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 15800, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 4.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00226c6ec87f03c19d4cd974c381c54cf950ec3bdc08\u0022, \u0022event_fingerprint\u0022: \u00220733c11d387267791c9e199c9e528715e5473467\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.08, \u0022classification_confidence\u0022: 0.08, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 6206, \u0022org\u0022: \u0022Netrouting B.V.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022f89ea94ae2dff86045a6e3e343e61922\u0022, \u0022payload_hash\u0022: \u0022984e8a2e8d8adf01d072a18a09fa0c6e\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 15800, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 24}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002:\\u0001\\u0000\\u00026\\u0003\\u0003\\r0z\ufffd\\b\\u001b\ufffdD1\\u001c,iZ\ufffd\\u0007a6\u003C\ufffd\\u0016\\u0003\ufffd\ufffd\\\\\ufffd\ufffd\\u0005}\\u0000 ^{E\ufffdPhcN\\u001d\ufffd\\u00006$;C\ufffd\\u000f\u0026y\ufffd=\ufffd\ufffdL\ufffdx\ufffd_t\ufffd\ufffd\\u0000 \\n\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\n\\n\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002:\\u0001\\u0000\\u00026\\u0003\\u0003\\r0z\ufffd\\b\\u001b\ufffdD1\\u001c,iZ\ufffd\\u0007a6\u003C\ufffd\\u0016\\u0003\ufffd\ufffd\\\\\ufffd\ufffd\\u0005}\\u0000 ^{E\ufffdPhcN\\u001d\ufffd\\u00006$;C\ufffd\\u000f\u0026y\ufffd=\ufffd\ufffdL\ufffdx\ufffd_t\ufffd\ufffd\\u0000 \\n\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\n\\n\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\ufffd\\u0001\\u0000\\u0001\\u0000\\u00003\\u0000+\\u0000)\ufffd\ufffd\\u0000\\u0001\\u0000\\u0000\\u001d\\u0000 \ufffd\ufffd\\u0015\u003EU\\u0006\ufffd\u07ae\u003C1Eo\ufffd)\ufffd)\ufffd5R\\u001c\\u0000s\ufffd\ufffd\ufffd\ufffd.\\u001d\ufffd\\u0010\\u0012\\u0000+\\u0000\\u0007\\u0006**\\u0003\\u0004\\u0003\\u0003\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000Di\\u0000\\u0005\\u0000\\u0003\\u0002h2\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\n\\u0000\\b\ufffd\ufffd\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u0012\\u0000\\u0010\\u0004\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002:\\u0001\\u0000\\u00026\\u0003\\u0003\\r0z\ufffd\\b\\u001b\ufffdD1\\u001c,iZ\ufffd\\u0007a6\u003C\ufffd\\u0016\\u0003\ufffd\ufffd\\\\\ufffd\ufffd\\u0005}\\u0000 ^{E\ufffdPhcN\\u001d\ufffd\\u00006$;C\ufffd\\u000f\u0026y\ufffd=\ufffd\ufffdL\ufffdx\ufffd_t\ufffd\ufffd\\u0000 \\n\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\n\\n\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228e92ce3c214ee6767f1cb085c9ed7afbbf3ad3e6\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002:\\u0001\\u0000\\u00026\\u0003\\u0003\\r0z\ufffd\\b\\u001b\ufffdD1\\u001c,iZ\ufffd\\u0007a6\u003C\ufffd\\u0016\\u0003\ufffd\ufffd\\\\\ufffd\ufffd\\u0005}\\u0000 ^{E\ufffdPhcN\\u001d\ufffd\\u00006$;C\ufffd\\u000f\u0026y\ufffd=\ufffd\ufffdL\ufffdx\ufffd_t\ufffd\ufffd\\u0000 \\n\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\n\\n\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f89ea94ae2dff86045a6e3e343e61922\u0022, \u0022port\u0022: 15800, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022:6\\r0z\ufffd\ufffdD1,iZ\ufffda6\u003C\ufffd\ufffd\ufffd\\\\\ufffd\ufffd} ^{E\ufffdPhcN\ufffd6$;C\ufffd\u0026y\ufffd=\ufffd\ufffdL\ufffdx\ufffd_t\ufffd\ufffd \\n\\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\\n\\n#\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:15800 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002215800 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 8, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 15800, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002:\\u0001\\u0000\\u00026\\u0003\\u0003\\r0z\ufffd\\b\\u001b\ufffdD1\\u001c,iZ\ufffd\\u0007a6\u003C\ufffd\\u0016\\u0003\ufffd\ufffd\\\\\ufffd\ufffd\\u0005}\\u0000 ^{E\ufffdPhcN\\u001d\ufffd\\u00006$;C\ufffd\\u000f\u0026y\ufffd=\ufffd\ufffdL\ufffdx\ufffd_t\ufffd\ufffd\\u0000 \\n\\n\\u0013\\u0001\\u0013\\u0002\\u0013\\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\\u0013\ufffd\\u0014\\u0000\ufffd\\u0000\ufffd\\u0000\/\\u00005\\u0001\\u0000\\u0001\ufffd\\n\\n\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\u0012\\u0000\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022f89ea94ae2dff86045a6e3e343e61922\u0022, \u0022port\u0022: 15800, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:15800 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022:6\\r0z\ufffd\ufffdD1,iZ\ufffda6\u003C\ufffd\ufffd\ufffd\\\\\ufffd\ufffd} ^{E\ufffdPhcN\ufffd6$;C\ufffd\u0026y\ufffd=\ufffd\ufffdL\ufffdx\ufffd_t\ufffd\ufffd \\n\\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\\n\\n#\u0022, \u0022target_port_label\u0022: \u002215800 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002215800\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022port:18099\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"f89ea94ae2dff86045a6e3e343e61922","tls_ja3":"771,2570-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,2570-35-18-11-16-65281-51-43-5-17513-23-10-13-27-45-65037-14906,56026-29-23-24,0","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":575}],"total_events":49}