5.252.83.60

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 657,
    "payload_entropy": 7.093422210104036,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 25369,
    "country": "GB",
    "dst_port": 3224,
    "risk_waf": 8,
    "risk_classification": 62,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "7171c4c3ba522db33ccee045deafe37e55043c13",
    "event_fingerprint": "b626ae312d467805635d3cedc682ce5b5db13a44",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0771"
    ],
    "classification_reason": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 62,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 35
    },
    "service_name": "sap-diag",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a977df4406e9eb7bd3b9095b52856785",
        "path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
    },
    "target_context": {
        "dst_port": 3224,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0002\ufffd\u0001\u0000\u0002\ufffd\u0003\u0003\ufffd\ufffd\ufffd ^\u01bf\u077f\u0012\ufffd\"\ufffd\ufffd>\u000bNO\ufffd\ufffd\ufffd\u0005\ufffd\ufffd4:\ufffd27.1\ufffd \ufffd\u07c0$r\ufffd-\ufffd\u0004>\ufffd\udb9e\udd659\ufffd\ufffdQ\ufffdf\ufffdV\ufffd$\ufffd\ufffd\ufffd'\ufffd\ufffd\u0000F\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd'\ufffd#\u032a\u0000\ufffd\u0000\ufffd\u0000g\u0000k\u00003",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0002\ufffd\u0001\u0000\u0002\ufffd\u0003\u0003\ufffd\ufffd\ufffd ^\u01bf\u077f\u0012\ufffd\"\ufffd\ufffd>\u000bNO\ufffd\ufffd\ufffd\u0005\ufffd\ufffd4:\ufffd27.1\ufffd \ufffd\u07c0$r\ufffd-\ufffd\u0004>\ufffd\udb9e\udd659\ufffd\ufffdQ\ufffdf\ufffdV\ufffd$\ufffd\ufffd\ufffd'\ufffd\ufffd\u0000F\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd'\ufffd#\u032a\u0000\ufffd\u0000\ufffd\u0000g\u0000k\u00003\u00009\u0000<\ufffd\u0012\u0000\u0016\u0000\n\u0000\u0005\ufffd\u0011\ufffd\u0007\ufffd\u0013\ufffd\u0014\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\u000e\u0000\f\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0001\u0000\u0001\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\"\u0000\n\u0000\b\u0004\u0003\u0005\u0003\u0006\u0003\u0002\u0003\u00003\u0000k\u0000i\u0000\u001d\u0000 \ufffd\u0637\u001f\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffdf\u0000\ufffdB\ufffdQA\ufffd\ufffd\u0001\ufffdns\ufffd7U\ufffd\ufffd:i;\u0000\u0017",
        "payload_snippet": "\u0016\u0003\u0001\u0002\ufffd\u0001\u0000\u0002\ufffd\u0003\u0003\ufffd\ufffd\ufffd ^\u01bf\u077f\u0012\ufffd\"\ufffd\ufffd>\u000bNO\ufffd\ufffd\ufffd\u0005\ufffd\ufffd4:\ufffd27.1\ufffd \ufffd\u07c0$r\ufffd-\ufffd\u0004>\ufffd\udb9e\udd659\ufffd\ufffdQ\ufffdf\ufffdV\ufffd$\ufffd\ufffd\ufffd'\ufffd\ufffd\u0000F\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd'\ufffd#\u032a\u0000\ufffd\u0000\ufffd\u0000g\u0000k\u00003",
        "classification_reason": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "sap_probe"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b3d7f2d082f0451b68dc0f0735fb2a3ba31eb977",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0002\ufffd\u0001\u0000\u0002\ufffd\u0003\u0003\ufffd\ufffd\ufffd ^\u01bf\u077f\u0012\ufffd\"\ufffd\ufffd>\u000bNO\ufffd\ufffd\ufffd\u0005\ufffd\ufffd4:\ufffd27.1\ufffd \ufffd\u07c0$r\ufffd-\ufffd\u0004>\ufffd\udb9e\udd659\ufffd\ufffdQ\ufffdf\ufffdV\ufffd$\ufffd\ufffd\ufffd'\ufffd\ufffd\u0000F\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd'\ufffd#\u032a\u0000\ufffd\u0000\ufffd\u0000g\u0000k\u00003",
        "port": 3224,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd ^\u01bf\u077f\ufffd\"\ufffd\ufffd>NO\ufffd\ufffd\ufffd\ufffd\ufffd4:\ufffd27.1\ufffd \ufffd\u07c0$r\ufffd-\ufffd>\ufffd\udb9e\udd659\ufffd\ufffdQ\ufffdf\ufffdV\ufffd$\ufffd\ufffd\ufffd'\ufffd\ufffdF\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd'\ufffd#\u032a\ufffd\ufffdgk3",
    "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3224 \u00b7 (sonde \/ probe)",
    "target_port_label": "3224 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 62,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3224,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0771"
        ],
        "tags_summary_labels_fr": [
            "pat-0771"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0002\ufffd\u0001\u0000\u0002\ufffd\u0003\u0003\ufffd\ufffd\ufffd ^\u01bf\u077f\u0012\ufffd\"\ufffd\ufffd>\u000bNO\ufffd\ufffd\ufffd\u0005\ufffd\ufffd4:\ufffd27.1\ufffd \ufffd\u07c0$r\ufffd-\ufffd\u0004>\ufffd\udb9e\udd659\ufffd\ufffdQ\ufffdf\ufffdV\ufffd$\ufffd\ufffd\ufffd'\ufffd\ufffd\u0000F\u0013\u0001\u0013\u0003\u0013\u0002\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd'\ufffd#\u032a\u0000\ufffd\u0000\ufffd\u0000g\u0000k\u00003",
            "port": 3224,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3224 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd ^\u01bf\u077f\ufffd\"\ufffd\ufffd>NO\ufffd\ufffd\ufffd\ufffd\ufffd4:\ufffd27.1\ufffd \ufffd\u07c0$r\ufffd-\ufffd>\ufffd\udb9e\udd659\ufffd\ufffdQ\ufffdf\ufffdV\ufffd$\ufffd\ufffd\ufffd'\ufffd\ufffdF\ufffd+\ufffd\/\u0329\u0328\ufffd,\ufffd0\ufffd\n\ufffd\t\ufffd\ufffd\ufffd\ufffd\/5\ufffd'\ufffd#\u032a\ufffd\ufffdgk3",
        "target_port_label": "3224 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3224"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "tls_clienthello"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "8bffc775b8a3a125878c1623f8a585ff363646b5",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 443,
    "payload_entropy": 5.211509908334601,
    "port_category": "well_known",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 417,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 62,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "f9221a027783af2681bf2d53d3048db9b5e667b8",
    "event_fingerprint": "8348f1132c4dd5d8e775d47f93ea6ac904c38850",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 62,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "cb710fa3ecb8514bff06577e85b38f5d",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 417,
        "service": "http",
        "service_name": "http",
        "risk_score": 62
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:417\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Leng",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:417\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version: 2",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:417\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Leng",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:417\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version: 2",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:417\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Leng",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "29ea0e54a9aa4826e9c67ba492de6a7863918a80",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 417,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:417\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Leng",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:417 \u00b7 (tentative d'exploit)",
    "target_port_label": "417 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 62\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 62,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 62,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 417,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 417,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:417 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:417\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Leng",
        "target_port_label": "417 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "417"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "33bb7549dfc6ba94e0bfb8e2b20487bbe441804b",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 445,
    "payload_entropy": 5.215560581329866,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 13184,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "b4d678c9381748d89f168678683c0cbfb369e2ed",
    "event_fingerprint": "881c223a46224628a3f1680f19edf0fcf6ee8a38",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "c0deaf5b568646e5654167dc8565184c",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 13184,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:13184\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:13184\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:13184\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:13184\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:13184\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "069da901c90d283841e31421c4693a9556e82487",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 13184,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:13184\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:13184 \u00b7 (tentative d'exploit)",
    "target_port_label": "13184 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 13184,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 13184,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:13184 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:13184\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "target_port_label": "13184 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "13184"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "3b934282358b77bff6fe4faf24f05579a55c4d25",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 448,
    "payload_entropy": 5.212240515728348,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 15773,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 63,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "f0ad4190d0b94767ad9daa65b6aee88e1f9fe22e",
    "event_fingerprint": "03871fd7ff52fb441a765f05a7f0332275117a0a",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 63
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "c61240ec4aa514c382d8499a1442f81c",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 15773,
        "service": "http",
        "service_name": "http",
        "risk_score": 63
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15773\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15773\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15773\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15773\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15773\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ac852b14107df716f37e408a76dc703510e046b7",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 15773,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15773\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:15773 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "15773 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 63
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 63,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 15773,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 15773,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:15773 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:15773\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "target_port_label": "15773 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "15773"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "de705082eee183a38d01088340d4a9d87b8de157",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 448,
    "payload_entropy": 5.225187544879643,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 17979,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 64,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "0f634d6fdad3c2ffacd92c0ab38cf16e9358b1de",
    "event_fingerprint": "41a80334619f659b498c915a1c7f3aab7c43a6da",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 64
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "f2f1f964c72f02bb6726b47f033af1ad",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 17979,
        "service": "http",
        "service_name": "http",
        "risk_score": 64
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:17979\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:17979\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:17979\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:17979\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:17979\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "be84d2a0974a96359705293db4d4a29b1cbb9b73",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 17979,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:17979\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:17979 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "17979 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 64
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 64,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 17979,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 17979,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:17979 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:17979\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "target_port_label": "17979 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "17979"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "91a62cd76d7aed3cacfbca7856d4ea6dcd643e0a",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 174,
    "payload_entropy": 5.165730621863446,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 11610,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 57,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "1767e28a4490313f81182ef0635e3b43c7480210",
    "event_fingerprint": "34adf42596ad8bd1fd25a6d0d54cc1916a1660a4",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 57
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "bfd10a2e716914bc6d455f61511cb099",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 11610,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11610\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11610\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11610\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11610\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11610\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "92ea10ab1a430c0d764fcde7f1de1d5817224503",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 11610,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11610\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:11610 \u00b7 (tentative d'exploit)",
    "target_port_label": "11610 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 57
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 11610,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 11610,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:11610 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11610\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "target_port_label": "11610 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "11610"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "feb7904743dce3a175c9c787a6e6029af04045c2",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 445,
    "payload_entropy": 5.2141466701319095,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 11842,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "a4948e8e73b9dae93cace894493165b1d6a14d20",
    "event_fingerprint": "31891f0242211eccab3e532233b333ddba6746eb",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 60,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "6eaaf0665aa0aa6bcb2d5f3a28c1fae9",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 11842,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11842\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11842\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11842\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11842\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version:",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11842\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "76b33aa623ad12c38e7469bb913e1f0e985c1087",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 11842,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11842\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:11842 \u00b7 (tentative d'exploit)",
    "target_port_label": "11842 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 60,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 11842,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 11842,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:11842 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11842\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Le",
        "target_port_label": "11842 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "11842"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 5,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "e913198e0bde7fb213d8d934a8ff17fdf6b24e6d",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 185,
    "payload_entropy": 5.1609880001582935,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 21300,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "684e557642d2046f8c866657a28dbd6a207fa6f5",
    "event_fingerprint": "c1a0d7df043d593ae5f787698cfc75e9e0be5997",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.5,
    "classification_confidence": 0.5,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 55
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "41dc9891735a87cfdae973ee9159bb48",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 21300,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21300\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21300\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21300\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21300\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21300\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c89b27d2429341653f8cd634ecd9492bc2a00b87",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 21300,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21300\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:21300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "21300 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 55
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 21300,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 21300,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:21300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:21300\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "target_port_label": "21300 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "21300"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "65c810790d0a8852709f103b52ed8db49d7e7006",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 184,
    "payload_entropy": 5.173437365317213,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 5395,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "dccbf98512bcdf99f4c628b21e384f838303bc9e",
    "event_fingerprint": "a899ac66b95a703db14dc0ee2780ef2281639e88",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.5,
    "classification_confidence": 0.5,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 54
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "6ee0054628db13a6b7d83075caf4d2ee",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 5395,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5395\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5395\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5395\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5395\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5395\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6159029f365dd5e68944130b74ae13123d5157aa",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 5395,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5395\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:5395 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "5395 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 54
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5395,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 5395,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:5395 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:5395\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
        "target_port_label": "5395 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5395"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "e262a266419efddb0c7ee71c21c375363a57f76a",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 185,
    "payload_entropy": 5.185799299973335,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 24125,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "a17b3688fb8d100a20c350c906c7493c9be3fb12",
    "event_fingerprint": "96fd2a93008f4c5bf377e84a79fd083c75995fe0",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.6,
    "classification_confidence": 0.6,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "f9b1ba44aa8f73403ad8c2b3e22cabc5",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 24125,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:24125\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:24125\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:24125\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:24125\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:24125\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "43af2d427a6cb6173bd226512b6db1acf1d76e0c",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 24125,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:24125\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:24125 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "24125 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 60 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 24125,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 24125,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:24125 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:24125\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "target_port_label": "24125 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "24125"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "f89aa037389c7f2572f2576171e33b85ceaa8f24",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.16900310811385,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 28823,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 58,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "670f0a0a416cef00be884c002c6c66e8982319c7",
    "event_fingerprint": "caec25d95cb6dff4d55325a3709f839ca6ab26d8",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 58,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "01542e00a0ad0a6c102e3e4a0fe59864",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 28823,
        "service": "http",
        "service_name": "http",
        "risk_score": 58
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:28823\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:28823\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:28823\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:28823\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:28823\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ffe0b145aa89cbf8a3bb4dd19bd97e4928e3b7e7",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 28823,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:28823\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:28823 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "28823 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 58,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 58,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 28823,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 28823,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:28823 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:28823\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "28823 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "28823"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": null,
    "app_proto": null,
    "asn": 25369,
    "country": "GB",
    "dst_port": 20483,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1defedb11c4c0c147a5fb799efa62bd112755f0e",
    "event_fingerprint": "748de0085a229a331ad81b9b1f892d7d28393e3a",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 20483,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a1833298a9dae0904d327817b5b89ad209dcd699",
    "protocol_details": {
        "port": 20483
    },
    "attack_vector": "Sonde port \u00b7 port 20483 \u00b7 (sonde \/ probe)",
    "target_port_label": "20483",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 20483,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 20483
        },
        "attack_vector": "Sonde port \u00b7 port 20483 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "20483",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "20483"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "6c5a8c5a114c18ff60e8bbd887d3ea0342c4eb7e",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 185,
    "payload_entropy": 5.18314943513186,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 25715,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 57,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "9a30e88d638684d5a9ea09a555bd732141342b4a",
    "event_fingerprint": "b670fc884ea31836bcf04b4b963b4f0c7f0d189c",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.5,
    "classification_confidence": 0.5,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 57
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "b6ae9d26896a50ac24b12ec2ee2704a3",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 25715,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25715\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\n",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25715\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25715\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25715\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25715\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "86c1e5a4fa97becccb6fb30143448db182c704ad",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 25715,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25715\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:25715 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "25715 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 57
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 25715,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 25715,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:25715 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:25715\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "target_port_label": "25715 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "25715"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "35514b403676deb1b83fef0e89622996a2af969c",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.16900310811385,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 29622,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 57,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b84f7676532d93db5121f565f0813697fd0ed0f2",
    "event_fingerprint": "da77ac6e9bbcbcc867fa9a71fac20126899780b7",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 57,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "b39b2dcc850d84adb79b37cb24315a4d",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 29622,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:29622\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:29622\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:29622\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:29622\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:29622\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "90df89e587692763c5fd96f36cc24ea5cc422076",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 29622,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:29622\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:29622 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "29622 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 57,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 29622,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 29622,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:29622 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:29622\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "29622 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "29622"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "78b5cd16a2c5bb8510eda505cbf609dcf0d4c8f5",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 184,
    "payload_entropy": 5.186971196815436,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 6762,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "0f404ff5c0d0fa0d3d45617e407049df12b27c33",
    "event_fingerprint": "d770b3104d4035517518c2674039027b68670a40",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.5,
    "classification_confidence": 0.5,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 55
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "1a5c823ddaef62a76a38316fe8f72f80",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 6762,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6762\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6762\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6762\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6762\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6762\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d0217bf471113eedff12060aa1d2835e3c7a633a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 6762,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6762\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:6762 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "6762 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 55
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6762,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 6762,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:6762 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6762\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nA",
        "target_port_label": "6762 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6762"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "6f0116c309582f99ec04fec5633dd8215d0d17e3",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.154579613338125,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 22663,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "9a1da27e4b78ed640c456a23acb999a1c18567ac",
    "event_fingerprint": "d09afb180003aadd8c6f8db234e4d2e2cb8731a8",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "df8466fd0dae442ac8f67ea6d0d4984b",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 22663,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22663\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22663\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22663\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22663\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22663\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "238106a2e672ba97980a9b0e6fa1148ba6db8924",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 22663,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22663\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:22663 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "22663 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 22663,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 22663,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:22663 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:22663\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "22663 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "22663"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "5a4a0dba5ebd01dcf9a4476c20784db8c2ca3672",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 443,
    "payload_entropy": 5.203309619258436,
    "port_category": "well_known",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 926,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 64,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "bed5da805a4447683947f80701673e140261f096",
    "event_fingerprint": "267fdba4d0cca81ee425805e8d09aad9976c4713",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 64,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "8846bfd2cad695acf2c3a05883ad9ee7",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 926,
        "service": "http",
        "service_name": "http",
        "risk_score": 64
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:926\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Leng",
    "method": "POST",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "POST \/ HTTP\/1.1",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:926\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version: 2",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:926\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Leng",
    "evidence": {
        "method": "POST",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "POST \/ HTTP\/1.1",
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:926\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Version: 2",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:926\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Leng",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7418cf338089341c051f6720a5eecdc0425856df",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/",
        "request_line": "POST \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 926,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:926\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Leng",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:926 \u00b7 (tentative d'exploit)",
    "target_port_label": "926 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 64,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 64,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 926,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/",
            "request_line": "POST \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 926,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:926 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:926\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Leng",
        "target_port_label": "926 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 6 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "926"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 4,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "148769d58267867ebda537ce07ce0e8bcda36ed6",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 174,
    "payload_entropy": 5.216046067278179,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 28938,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 57,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "98414977438cd5455286e2d3478edd3d68f374ba",
    "event_fingerprint": "8a82554eb9332d52dd8cedadf397d00d93cf8140",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 57
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "1e65bd207e2946a2785a101970558b0b",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 28938,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:28938\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:28938\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:28938\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:28938\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:28938\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8e6fb309f7bcb9ea8ed8bb7e9fcd914e3f917b17",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 28938,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:28938\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:28938 \u00b7 (tentative d'exploit)",
    "target_port_label": "28938 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 57
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 28938,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 28938,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:28938 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:28938\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "target_port_label": "28938 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "28938"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "e1c6adb3c187c89a73c3443eb8a60ed7d0b31319",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 174,
    "payload_entropy": 5.193057561531052,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 23240,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 58,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "7eea0f3ba9fef3ff09b3078d207ea1cfec6a661e",
    "event_fingerprint": "3e3e87fe0a3acf5d7ab3ea2a04be72667b831f59",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 58
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "700874ed1098a32ed49b8c0895328f69",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 23240,
        "service": "http",
        "service_name": "http",
        "risk_score": 58
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:23240\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:23240\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:23240\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:23240\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:23240\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2c65e39252e52fcb446aad68fb55f4a0a4115224",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 23240,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:23240\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:23240 \u00b7 (tentative d'exploit)",
    "target_port_label": "23240 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 58
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 58,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 23240,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 23240,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:23240 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:23240\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "target_port_label": "23240 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "23240"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "34e10da52e9d058077932c93f26675c037d3d143",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.158009048060919,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 30880,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "9ca948c1b57ccd5110d68810daffabf14859f085",
    "event_fingerprint": "b511f875c12fa5df105380f83ad2cd727625eec5",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.69,
    "classification_confidence": 0.69,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "2ce9fb67d60190651dcfe90f9526f59a",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 30880,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:30880\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:30880\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:30880\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:30880\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:30880\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7031b6a7ef654a97d0119d1b8d18dee7844db7c6",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 30880,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:30880\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:30880 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "30880 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 69 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 69,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 30880,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 30880,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:30880 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:30880\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "30880 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 69 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "30880"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "8778407f487bd1f5c663ce42d947f6244df9bfcb",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 448,
    "payload_entropy": 5.196587301593244,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 21061,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "bd478cc454e71433b71c2af0da738e41ded5e75e",
    "event_fingerprint": "eaa18029a619f2c1900a8b04687b526e4a6cd762",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "c9c3ba9d21ad5b16f287318de659c2dd",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 21061,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21061\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21061\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21061\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21061\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21061\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "52290eed59a1ddd7f1bba68edb3557e3c4b6772c",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 21061,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21061\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:21061 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "21061 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne \/24 (5.252.83.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 10
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 21061,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 21061,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:21061 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:21061\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "target_port_label": "21061 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +10 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (5.252.83.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "21061"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "5.252.83.0\/24",
    "coordinated_ip_count": 6,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "99375fcf9e7d521984a7e6e8760a4d59eb12d945",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 174,
    "payload_entropy": 5.20245682603335,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 15917,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 57,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "ac5599d79a3f7bbf8c56bc31cfffb0f94f636920",
    "event_fingerprint": "1a2b3cebe2162278cafb32bd37e7c2f612d02b7e",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 57
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "e6b1b1705a022a31e8f94ae736629425",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 15917,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:15917\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:15917\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:15917\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:15917\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:15917\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "683ec60b10d4d454d1c230474ec4cf3a7547b6e8",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 15917,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:15917\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:15917 \u00b7 (tentative d'exploit)",
    "target_port_label": "15917 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 57
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 15917,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 15917,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:15917 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:15917\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: *\/*",
        "target_port_label": "15917 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "15917"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 5,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "5a5348defe304c1d08cd53757122e3dca61b3d8f",
    "http_target_hash": "a86b90c44ea188f3d86201cc14f47bf56d184d49",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.137589495548405,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 31233,
    "risk_waf": 100,
    "risk_classification": 78,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 57,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "621ff1fa36d5f6dcc532b1b0b010edd90d5b0cb7",
    "event_fingerprint": "4a645337e8982e2bf005a3b5b92c09b907aa7511",
    "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "CRS-930100-sub"
    ],
    "kb_rule_ids": [
        "CRS-930100-sub"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 78,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 57
    },
    "named_classification_skipped": false,
    "classification_parent": "path_traversal",
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "cca6e2d7161bd5a1124b25dcc36416b1",
        "path_pattern_hash": "9c55a765acd7167a274de1a30a6df566"
    },
    "target_context": {
        "dst_port": 31233,
        "service": "http",
        "service_name": "http",
        "risk_score": 57
    },
    "payload_preview": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:31233\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: ",
    "method": "GET",
    "path": "\/sse",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/sse HTTP\/1.1",
    "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:31233\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:31233\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "evidence": {
        "method": "GET",
        "path": "\/sse",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/sse HTTP\/1.1",
        "request_sample": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:31233\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept: text\/event-stream\r\nConnection: close\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:31233\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "path_traversal"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "faca7645aaaf1653df174a32dd034b2f425c550d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/sse",
        "request_line": "GET \/sse HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 31233,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:31233\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
    "attack_vector": "lfi path traversal \u00b7 via HTTP:31233 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
    "target_port_label": "31233 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 57\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 78,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 57
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 57,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 31233,
        "protocol_emulated": null,
        "tags_summary": [
            "CRS-930100-sub"
        ],
        "tags_summary_labels_fr": [
            "CRS-930100-sub"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/sse",
            "request_line": "GET \/sse HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 31233,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "lfi path traversal \u00b7 via HTTP:31233 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sse",
        "evidence_snippet": "GET \/sse HTTP\/1.1\r\nHost: 62.3.50.33:31233\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nAccept:",
        "target_port_label": "31233 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "31233"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "32491dfd4a70ac007cd199f117480c806156be50",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 447,
    "payload_entropy": 5.222898392602275,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 8714,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "d0cdf77ff78227ee2ff93414e8d1016f40c340a1",
    "event_fingerprint": "4403d2aec5a1c6695f0e6a2e02d63a3abb259575",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 60
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "ce1aed3a984c0fc1cd3dfa916604b4e8",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 8714,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8714\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8714\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versio",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8714\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8714\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versio",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8714\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1c412d06f63e651b9eb9b80274dd417a426d0680",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 8714,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8714\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:8714 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "8714 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 60
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8714,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 8714,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:8714 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:8714\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-",
        "target_port_label": "8714 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8714"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 8,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "d21c1bafc58d16443d9ec66887a72f8ca1f87ea1",
    "http_host_hash": "0a1883ae605a2afb5ec0b56a36de103794b4f6c2",
    "http_target_hash": "b6dd5207698ea0722ea3c46de82524f56e66f110",
    "http_referer_hash": null,
    "http_method": "POST",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 448,
    "payload_entropy": 5.206459063795797,
    "port_category": "registered",
    "org": "Hydra Communications Ltd",
    "service": "http",
    "app_proto": "http",
    "asn": 25369,
    "country": "GB",
    "dst_port": 11433,
    "risk_waf": 100,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25
    },
    "risk_score": 63,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "b0c16b04d2d2cad83b20258a0255792c94313373",
    "event_fingerprint": "eb3a9fcb408db453957c969c7b6a36ddd1d143eb",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0842",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 85,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 25,
        "risk_score": 63
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "GB",
        "asn": 25369,
        "org": "Hydra Communications Ltd",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "d74db3be8cf3d2c61a6ebef42022c154",
        "payload_hash": "c5ec93bf2439990d3758137a5d504541",
        "path_pattern_hash": "88fe637beab867e285c088d60d6cc3b3"
    },
    "target_context": {
        "dst_port": 11433,
        "service": "http",
        "service_name": "http",
        "risk_score": 63
    },
    "payload_preview": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11433\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "method": "POST",
    "path": "\/mcp",
    "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
    "waf_tags": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "lfi-14",
        "rce-0",
        "rce-14",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "POST \/mcp HTTP\/1.1",
    "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11433\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
    "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11433\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "evidence": {
        "method": "POST",
        "path": "\/mcp",
        "user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "waf_tags": [
            "950318:lfi-14",
            "950326:rce-0",
            "950383:rce-14",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "lfi-14",
            "rce-0",
            "rce-14",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "POST \/mcp HTTP\/1.1",
        "request_sample": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11433\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent-Length: 151\r\nAccept: application\/json, text\/event-stream\r\nConnection: close\r\nContent-Type: application\/json\r\nMcp-Protocol-Versi",
        "payload_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11433\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "620125ee65d39c33599cc5b00697e58568332c4e",
    "protocol_details": {
        "http_method": "POST",
        "http_path": "\/mcp",
        "request_line": "POST \/mcp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
        "port": 11433,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11433\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
    "attack_vector": "http smuggling probe \u00b7 via HTTP:11433 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
    "target_port_label": "11433 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 85,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 25,
            "risk_score": 63
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 63,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 11433,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "POST",
            "http_path": "\/mcp",
            "request_line": "POST \/mcp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)",
            "port": 11433,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http smuggling probe \u00b7 via HTTP:11433 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mcp",
        "evidence_snippet": "POST \/mcp HTTP\/1.1\r\nHost: 62.3.50.33:11433\r\nUser-Agent: Mozilla\/5.0 (compatible; Infrawatch\/1.0; +https:\/\/infrawat.ch\/)\r\nContent",
        "target_port_label": "11433 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "11433"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950318:lfi-14",
        "950326:rce-0",
        "950383:rce-14",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}