5.252.83.211

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "08c60116cbaf11abef28262b02491200e0a586f5",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 445,
    "payload_entropy": 5.2063899206618345,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 25593,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 62,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "015f5649d9d658df3cf988d25f547c86925308a8",
    "event_fingerprint": "ead1d431ba91fd305ca0be2683937ea9ba45f11f",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 62,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "a061aa62488ef5fd09312da80cf9babb",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 25593,
        "service": "http",
        "service_name": "http",
        "risk_score": 62
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:25593\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:25593\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:25593\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:25593\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:25593\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ace54bbdcf744d2db6289707ebd94ec102dc1ed0",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 25593,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:25593\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:25593 \u00b7 (tentative d'exploit)",
    "target_port_label": "25593 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 62,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 62,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 25593,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 25593,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:25593 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:25593\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "target_port_label": "25593 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "25593"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "e7ac7ecd794e71914a63e2cbdca798fceb5afd12",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 144,
    "payload_entropy": 5.097605644356062,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 7189,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 59,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "50a7e88990c51ddcdc31b060eda8ef3eae5379dc",
    "event_fingerprint": "721021ac2b3be162f407382e363cebe39c5f46cd",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 59
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "973598b044a4648e3c3fc5667c0c8ce9",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 7189,
        "service": "http",
        "service_name": "http",
        "risk_score": 59
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a76cc599921e607b4bf5c7f75b0c77a0df7e574a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 7189,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:7189 \u00b7 (tentative d'exploit)",
    "target_port_label": "7189 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 59
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 59,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 7189,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 7189,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:7189 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
        "target_port_label": "7189 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "7189"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "fee345c1f07f5ffa2ec095c5588cce09171c2e43",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 448,
    "payload_entropy": 5.21530035840002,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 28339,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "088abeb5e6fd0b642bcf63dbb26b5bd8ab63d071",
    "event_fingerprint": "a6fbf0bf933f0473a2282ada94cc730407186edb",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 60,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "2e51a0f00797baf81286b44552facdff",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 28339,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:28339\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:28339\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:28339\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:28339\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:28339\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b8d48b53fd20cd80102972a897d680f1e63911c3",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 28339,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:28339\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:28339 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "28339 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 60,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 28339,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 28339,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:28339 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:28339\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "target_port_label": "28339 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "28339"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": null,
    "app_proto": null,
    "asn": 25369,
    "country": "GB",
    "dst_port": 12483,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4f173a0f5970e651c098cd34790a2dc8e6729ef5",
    "event_fingerprint": "76ec0c0c498959d1933225e61ca016779108916f",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 12483,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "201441314b80e51ab635d04f6b6c020357795d9d",
    "protocol_details": {
        "port": 12483
    },
    "attack_vector": "Sonde port \u00b7 port 12483 \u00b7 (sonde \/ probe)",
    "target_port_label": "12483",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 12483,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 12483
        },
        "attack_vector": "Sonde port \u00b7 port 12483 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "12483",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "12483"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "e2d412f563d381fccbe17eed58542f48fe7163dd",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.193897807078057,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 18449,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ae89a3f01f47256d653b7b6afe385484c3f34d82",
    "event_fingerprint": "a48c6711b9b7c5d97f46e0d1cab956ff809643b7",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "216858949938450492d308f9f6e26176",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 18449,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:18449\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:18449\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:18449\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:18449\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:18449\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "257b5b2bfe4dd296479606384ba5abea825ad8ec",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 18449,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:18449\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:18449 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "18449 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 18449,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 18449,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:18449 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:18449\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "18449 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "18449"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "ce13685182cdbd1c3dcb346c2aea0110b03b8800",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 173,
    "payload_entropy": 5.190495048021473,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 3586,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 58,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "cadd1748f4d8ca8db20b7245985f2f70aa0c7ef3",
    "event_fingerprint": "5189dffd42d1b8991f0ffc40abaf0781ffc4f810",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 58
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "3aff10cfbcd2b23714f56768c159a0f4",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 3586,
        "service": "http",
        "service_name": "http",
        "risk_score": 58
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3586\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3586\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3586\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3586\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3586\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4b48b54871450867152ff307ba1d6ba64d64630b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 3586,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3586\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:3586 \u00b7 (tentative d'exploit)",
    "target_port_label": "3586 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 58
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 58,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 3586,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 3586,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:3586 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3586\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "target_port_label": "3586 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "3586"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "323230206d61696c2e6578616d706c652e636f6d2045534d545020506f737466697820285562756e7475290d0a",
    "emulator_response_len": 45,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Hydra Communications Ltd",
    "service": "smtps",
    "app_proto": "smtps",
    "asn": 25369,
    "country": "GB",
    "dst_port": 465,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "285aa12557c71de8da374e01f6ee4cd0ed6287cc",
    "event_fingerprint": "ece26b28632e9bedcfad19f3ade19a517de5274c",
    "classification_reason": "Type \u00ab port_465_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 40
    },
    "named_classification_skipped": true,
    "named_candidate": "smtp_probe",
    "service_name": "smtps",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "b05d2b3cc6e7841ebf1d3b3f6a2b095b"
    },
    "target_context": {
        "dst_port": 465,
        "service": "smtps",
        "service_name": "smtps",
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "44c5c3c0b0f3161650206342b58c670d188c44d2",
    "protocol_details": {
        "smtp_auth_fr": "Sonde protocole SMTP",
        "port": 465,
        "service": "smtps",
        "service_label_fr": "SMTPS"
    },
    "attack_vector": "port 465 tcp \u00b7 via SMTPS:465 \u00b7 (sonde \/ probe)",
    "target_port_label": "465 \u00b7 SMTPS",
    "emulator_service": "smtps",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_465_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_465_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "smtps",
        "service_label_fr": "SMTPS",
        "dst_port": 465,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-smtps",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "smtp_auth_fr": "Sonde protocole SMTP",
            "port": 465,
            "service": "smtps",
            "service_label_fr": "SMTPS"
        },
        "attack_vector": "port 465 tcp \u00b7 via SMTPS:465 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "465 \u00b7 SMTPS",
        "emulator_service": "smtps",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "smtps",
        "service_banner": "honeypot-smtps",
        "service_os": "linux",
        "dst_port": "465"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_smtp_probe",
        "smtp_emulated"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "f20fe777b54ae18301da03f4d062523608d61ffe",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.145494076722891,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 22203,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "68f39749eeb666dbcca0ddc94ad59b8886e300c2",
    "event_fingerprint": "0254b188ba28a3abbd99ba8bd08e78d80a8c1568",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "f5ad3474267fd960a4921703c2abf4f4",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 22203,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22203\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22203\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22203\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22203\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22203\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fbeac9716bc9d3763bb504e9ef7f9bc2a4963e1a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 22203,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22203\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:22203 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "22203 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 22203,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 22203,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:22203 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22203\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "22203 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "22203"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "9a995a9edc2b582d55bac96fb4ef82c9d13e61de",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 448,
    "payload_entropy": 5.205696920067457,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 15045,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "102e25547ca22fa6c0561ed2cd15e0c0c8487fba",
    "event_fingerprint": "4cc49a75b99befcf32a7db378aa3521f88ea998c",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "ce88ba17664cddf104cb4d83fdef9eb8",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 15045,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15045\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15045\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15045\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15045\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15045\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fcf98aeee4ea6f46670e8fab8ba669a4a23891d8",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 15045,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15045\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:15045 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "15045 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 15045,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 15045,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:15045 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15045\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "target_port_label": "15045 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "15045"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "5c1c0b919f58461af0a0326c92a0e6c0244422c2",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 448,
    "payload_entropy": 5.209073078475907,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 21424,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "578ba217e9f14f2bbea0b7fb6c3323d80197a943",
    "event_fingerprint": "06837596d81f75daec0dcfc24d567c65e2824ea2",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 60
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "b08dfbb77a0b39a06aa948b5bf53d117",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 21424,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21424\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21424\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21424\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21424\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21424\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "92c8145f78ee47086a4c2fb7ecc133090efc2c94",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 21424,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21424\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:21424 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "21424 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 60
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 21424,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 21424,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:21424 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21424\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "target_port_label": "21424 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "21424"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "5ba6e018e3442ee91b1b3c0b15ed540f1334cabd",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 184,
    "payload_entropy": 5.184306930534604,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 9912,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 58,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f8c4f311d98a8d31a31bbc1ca6944d303599fa9c",
    "event_fingerprint": "eb660732a048239b453fbf06690ee27c4ef9bf1d",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.6,
    "classification_confidence": 0.6,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 58,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "f76d65f5955d91d1e3b07c0762ae2787",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 9912,
        "service": "http",
        "service_name": "http",
        "risk_score": 58
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9912\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9912\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9912\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9912\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9912\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3473fa059d36e531fae7360c552aab6055dc3503",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 9912,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9912\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:9912 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "9912 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 58,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 58,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9912,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 9912,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:9912 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9912\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
        "target_port_label": "9912 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9912"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "0d21c40a4fd9da7942acfe67d3f80be7f68b95b2",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 445,
    "payload_entropy": 5.216626227542607,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 21764,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "9eb5324587635da031df0bc1633c587995867645",
    "event_fingerprint": "51351a894aca5475ba9daa903c9f679fd5f35c97",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 60
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "61ce164dd44e9beee99c27316f16a140",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 21764,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21764\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21764\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21764\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21764\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21764\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0b42c29a87555188829b89388fd3a7afb177a869",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 21764,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21764\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:21764 \u00b7 (tentative d'exploit)",
    "target_port_label": "21764 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 60
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 21764,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 21764,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:21764 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:21764\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "target_port_label": "21764 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "21764"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "e7ac7ecd794e71914a63e2cbdca798fceb5afd12",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 144,
    "payload_entropy": 5.097605644356062,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 4331,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 58,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "ed66f8005b82bd52869753a955cb127d337043b4",
    "event_fingerprint": "f0adc889c0518ee75ff8eacf4fc19b35e46b826f",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 58,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "973598b044a4648e3c3fc5667c0c8ce9",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 4331,
        "service": "http",
        "service_name": "http",
        "risk_score": 58
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "359c4c05cd6bfb1ebb546c95904e99dd429ce8ab",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 4331,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:4331 \u00b7 (tentative d'exploit)",
    "target_port_label": "4331 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 58,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 58,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4331,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 4331,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:4331 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
        "target_port_label": "4331 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4331"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "885794d54f541a71a9e471a5f3bb5e04880fcce5",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.171569731127845,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 22866,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 57,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "81ed635849c63cd487c83765993d6f538c28fd61",
    "event_fingerprint": "5660a00b24c77e0604b922926f57398f6bd66c75",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 57
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "935e5faf4ee2d51c776abd08f616ab4d",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 22866,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22866\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22866\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22866\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22866\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22866\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "02aab76c8bac98182ff90b4e5f7ca2554b780ce7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 22866,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22866\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:22866 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "22866 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 57
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 22866,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 22866,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:22866 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22866\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "22866 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "22866"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "e7ac7ecd794e71914a63e2cbdca798fceb5afd12",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 144,
    "payload_entropy": 5.097605644356062,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 15825,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 57,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "2045c259d20ebc149e94d9752947fa0690047670",
    "event_fingerprint": "bddd42f02ec6780d8dc54ae9305b9108ad23aa9d",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 57
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "973598b044a4648e3c3fc5667c0c8ce9",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 15825,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6aadf5fe191d3c7bec267835fc7d23d93c21d34f",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 15825,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:15825 \u00b7 (tentative d'exploit)",
    "target_port_label": "15825 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 57
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 15825,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 15825,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:15825 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
        "target_port_label": "15825 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "15825"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "c00566c82beb092b033c157732655e177dd71aa8",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 184,
    "payload_entropy": 5.186971196815437,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 9569,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 57,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "260590100030fc5a0caf50d996ea6be72352d50f",
    "event_fingerprint": "f60c554f3c399a760d0d631ddc69fee78751505c",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.6,
    "classification_confidence": 0.6,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 57,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "f4963ecff5417c7fbe94d645ecb23bc7",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 9569,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9569\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9569\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9569\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9569\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9569\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c3cf228ed6e121bc1468da9946287573235d9ccf",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 9569,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9569\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:9569 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "9569 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 57,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9569,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 9569,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:9569 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:9569\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
        "target_port_label": "9569 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9569"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "eb62ea7dd1e276ec7c8a1df7458718ec7168b6a5",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.1834266028895755,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 12846,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 56,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e0810ba55146487c409aae75c69203847616499a",
    "event_fingerprint": "8794b49cd7bed1ebeebb391834111f84e7d0e5f3",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 56,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "ab85495b8c5996d72c3c5d91b9a1a57b",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 12846,
        "service": "http",
        "service_name": "http",
        "risk_score": 56
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:12846\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:12846\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:12846\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:12846\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:12846\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "409364312832733466d22b9d24edaafd17eba1a7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 12846,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:12846\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:12846 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "12846 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 56,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 56,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12846,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 12846,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:12846 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:12846\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "12846 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12846"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "eb074d0431fbec6c57cdcdf5ea4e64682f9700a3",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 448,
    "payload_entropy": 5.207055953235861,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 12641,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 63,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "3381001376a49c06e5583b50722f59d7bd0b2a3e",
    "event_fingerprint": "d9db1b4e5ad6d78a012b2c615622c2eef68cb49d",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 63,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "c2ca15d0947313433ff4107cf6154dc9",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 12641,
        "service": "http",
        "service_name": "http",
        "risk_score": 63
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:12641\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:12641\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:12641\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:12641\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:12641\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fc52bd2cd636a528e206c84af3a61a861f48fe42",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 12641,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:12641\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:12641 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "12641 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 63,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 63,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 12641,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 12641,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:12641 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:12641\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "target_port_label": "12641 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "12641"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "e7ac7ecd794e71914a63e2cbdca798fceb5afd12",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 144,
    "payload_entropy": 5.097605644356062,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 1445,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 58,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "537feaac16f0afed1c5dafbd96cdc3630f06483d",
    "event_fingerprint": "f8394deba3fbce0e837df6d4bcc8272da6cc29ee",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 58
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "973598b044a4648e3c3fc5667c0c8ce9",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 1445,
        "service": "http",
        "service_name": "http",
        "risk_score": 58
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4a596565cd77259180bb296d87952cd6c98ec99b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 1445,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:1445 \u00b7 (tentative d'exploit)",
    "target_port_label": "1445 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 58
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 58,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1445,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 1445,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:1445 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 192.0.2.1\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConne",
        "target_port_label": "1445 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1445"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "behavior_alert_count": 2,
    "behavior_priority": 84
}