62.164.177.54

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 19157,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bef25391a6671f9b195810fc516ce324f0e05e38",
    "event_fingerprint": "aaad314d1be77adf795c39449a6f67c2106e64a9",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 19157,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9e804f0dddd014f28c03cfca58d1bae1ef21d714",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 19157
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 19157 \u00b7 (sonde \/ probe)",
    "target_port_label": "19157",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 19157,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 19157
        },
        "attack_vector": "rdp probe \u00b7 port 19157 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "19157",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "19157"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:15597",
        "port:19157"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 15597,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "487ed54530ca77c21aeef4a51624eb60b9b34657",
    "event_fingerprint": "ec6b5dc309a14faa2b7470dc9ad452309d1b8c65",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 15597,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e6619cd52b6fc12480202e8cbcce4b11447fe397",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 15597
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 15597 \u00b7 (sonde \/ probe)",
    "target_port_label": "15597",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 15597,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 15597
        },
        "attack_vector": "rdp probe \u00b7 port 15597 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "15597",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "15597"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:15597",
        "port:7336",
        "port:8024",
        "port:9239"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7336,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "460d75c94f97bfcadc640b64aa5bd26f98b50de4",
    "event_fingerprint": "2e6f32eda3a260079ed90b7585efc0e9c9c3e98d",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 7336,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f04cdab21f53f598ee12f89cb27e2db88c2855b7",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7336
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 7336 \u00b7 (sonde \/ probe)",
    "target_port_label": "7336",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7336,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7336
        },
        "attack_vector": "rdp probe \u00b7 port 7336 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7336",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7336"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 10,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:11410",
        "port:7034",
        "port:7192",
        "port:7336"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8024,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "0f1e0ae88e6a733f0e7892a3c69d422ecb6f1e81",
    "event_fingerprint": "3d47ee473243b8acb39ab111603a3863c4f2753d",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8024,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "60f346fadcd01c485bdac22eb057b8df8315081b",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8024
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8024 \u00b7 (sonde \/ probe)",
    "target_port_label": "8024",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8024,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8024
        },
        "attack_vector": "rdp probe \u00b7 port 8024 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8024",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8024"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:11410",
        "port:7034",
        "port:7192",
        "port:8024"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 9239,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "104be7e089414a9203fe6ed27141d0afb10ed1c4",
    "event_fingerprint": "2ac0ac48620825072e2454a2cb64eb0e895798f7",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 9239,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4c57e1511ce522f6fdf479f4d3fd966f6a6d0fba",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 9239
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 9239 \u00b7 (sonde \/ probe)",
    "target_port_label": "9239",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9239,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 9239
        },
        "attack_vector": "rdp probe \u00b7 port 9239 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "9239",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9239"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 8,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:11410",
        "port:7034",
        "port:7192",
        "port:9239"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7034,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "241d08c1293dd04e39ef4b6653a5970761899657",
    "event_fingerprint": "cef38ab106dd58616b684d0635ec665a100b0de6",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 7034,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3659df09e7c4c1a2328af857c91df1438725287b",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7034
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 7034 \u00b7 (sonde \/ probe)",
    "target_port_label": "7034",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (7 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7034,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7034
        },
        "attack_vector": "rdp probe \u00b7 port 7034 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7034",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7034"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 7,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:11410",
        "port:7034",
        "port:7192"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 11410,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e1a756220c255c1e247bd315dd3b608b79e79b87",
    "event_fingerprint": "64807ad57af7168c8235a23932abce1b015ee875",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 11410,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "59b098729dbdb6c43f924ecc72f5281654a7995e",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 11410
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 11410 \u00b7 (reconnaissance)",
    "target_port_label": "11410",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11410,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 11410
        },
        "attack_vector": "port scan syn \u00b7 port 11410 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "11410",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11410"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:11410",
        "port:7192"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 11130,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "aee1c1fd84a5e0de7fcf22829a426e7062e12b2a",
    "event_fingerprint": "49ab5e1b667824992b16abd7902430f032cf220a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 11130,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c45216d6a4c1268a43f4b2719ea6f250abfff152",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 11130
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 11130 \u00b7 (reconnaissance)",
    "target_port_label": "11130",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11130,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 11130
        },
        "attack_vector": "port scan syn \u00b7 port 11130 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "11130",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11130"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        7192,
        10073,
        11130,
        11216
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:7192"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 10073,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "52fd6fd9405f84a073ae5654656be87f57a4cf16",
    "event_fingerprint": "ef6a402bb0e8e82e933a881c7c3688f62ade995e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 10073,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "28b7f470918ac56d2315e4f5e633c486ad78cf81",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 10073
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 10073 \u00b7 (reconnaissance)",
    "target_port_label": "10073",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 10073,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 10073
        },
        "attack_vector": "port scan syn \u00b7 port 10073 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "10073",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "10073"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        7192,
        10073,
        10653,
        11216
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11216",
        "port:7192"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7192,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1d9dae1140abe66b70eb6d0949930b0e4fa49c48",
    "event_fingerprint": "bebc8ae4d74a689f12f97adcbb97f0ee5b85acef",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 7192,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "debc477a5ed30764d8a6a487ed3983d7217d3ad9",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7192
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 7192 \u00b7 (reconnaissance)",
    "target_port_label": "7192",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7192,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7192
        },
        "attack_vector": "port scan syn \u00b7 port 7192 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7192",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7192"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:10111",
        "port:10653",
        "port:11216",
        "port:6544",
        "port:7192"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 11216,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "c67b1ed4533058feb63495dfb0d18b9dc12f939a",
    "event_fingerprint": "75fbf3abb0167f893590d7a3a6f4e3902839e7b9",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 11216,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "512b5e9eeff2f4e10d30e90a7526153dc2ca82e0",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 11216
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 11216 \u00b7 (sonde \/ probe)",
    "target_port_label": "11216",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11216,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 11216
        },
        "attack_vector": "rdp probe \u00b7 port 11216 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "11216",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11216"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:10111",
        "port:10653",
        "port:11216",
        "port:6544"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 10653,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e08eebd3f0ea0dacba04ae93f258bd128b3b5877",
    "event_fingerprint": "daa0d12f0e7f36781ebca5690420b09a5bad6f1f",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 10653,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3974e34896a3ed4afa8b278ec2b1dac014710d0a",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 10653
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 10653 \u00b7 (sonde \/ probe)",
    "target_port_label": "10653",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 10653,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 10653
        },
        "attack_vector": "rdp probe \u00b7 port 10653 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "10653",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "10653"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:10111",
        "port:10653",
        "port:6544"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 10111,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "c29ddad6125f9be6eb5a250175b31f18d8600399",
    "event_fingerprint": "db0dad471b2570baf4e8d85c997edd145a019578",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 10111,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6c7c572dc53b87cf7e84f9104f581b02a049ba35",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 10111
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 10111 \u00b7 (reconnaissance)",
    "target_port_label": "10111",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 10111,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 10111
        },
        "attack_vector": "port scan syn \u00b7 port 10111 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "10111",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "10111"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "port:10111",
        "port:6544",
        "port:7378",
        "port:8068",
        "port:8593",
        "port:9434"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 6544,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "b6cbcc898567514aca5db7fa9dea014b4b825150",
    "event_fingerprint": "44bb6cb370753e242f731204e60b0041d3ccddb1",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 6544,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6501f6477c309322fdb326693067df923e78a716",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 6544
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 6544 \u00b7 (sonde \/ probe)",
    "target_port_label": "6544",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6544,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 6544
        },
        "attack_vector": "rdp probe \u00b7 port 6544 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "6544",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6544"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:6544",
        "port:7378",
        "port:8068",
        "port:8593",
        "port:9434"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7378,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "b5253bb9e05ea8818d2bde42f22305b98b73c905",
    "event_fingerprint": "47bac2de5af2a0f8e22d3fc13c966ed4c3a47d72",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 7378,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "18b5eafb2e898419bf97e95c517e08b01703b353",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7378
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 7378 \u00b7 (sonde \/ probe)",
    "target_port_label": "7378",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7378,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7378
        },
        "attack_vector": "rdp probe \u00b7 port 7378 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7378",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:6990",
        "port:7378",
        "port:8068",
        "port:8593",
        "port:9434"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 9434,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "997a5150930afac546e7802ec8eb277624d098c4",
    "event_fingerprint": "63a82d9afa19aa64cbf20f66f4044a4c1b9186a8",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 9434,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d342aab96f0593e001568f786abfaffb3d43f25b",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 9434
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 9434 \u00b7 (sonde \/ probe)",
    "target_port_label": "9434",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9434,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 9434
        },
        "attack_vector": "rdp probe \u00b7 port 9434 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "9434",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9434"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:6990",
        "port:8068",
        "port:8593",
        "port:9434"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8593,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f032dfcfdd1519d35fd6e829313435d758cd3c60",
    "event_fingerprint": "8935df2a256181c2e445ba3410fdac6131096b97",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8593,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a45899f5fcea9e7a4b8dc95c0c23ead239a2b0ff",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8593
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8593 \u00b7 (sonde \/ probe)",
    "target_port_label": "8593",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8593,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8593
        },
        "attack_vector": "rdp probe \u00b7 port 8593 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8593",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8593"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:6990",
        "port:8068",
        "port:8593"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8068,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1f251610e84324762e45ac94ef694fbfee2785bb",
    "event_fingerprint": "f405c3b1706ffffc78131946ad5ad738c84c6b87",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8068,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4513f1dc45f16004224ee2119a7ae7ca0b1f1db7",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8068
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8068 \u00b7 (sonde \/ probe)",
    "target_port_label": "8068",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8068,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8068
        },
        "attack_vector": "rdp probe \u00b7 port 8068 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8068",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8068"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:6990",
        "port:8068"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 6990,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2fc3712237def8a58a9498c003f6b9ac77182945",
    "event_fingerprint": "0d4109b085834f3f3b5d619c8e37857010d39c72",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 6990,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fc23a4c15f1ac077c632dd822c671fb8acbb1fc4",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 6990
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 6990 \u00b7 (sonde \/ probe)",
    "target_port_label": "6990",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6990,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 6990
        },
        "attack_vector": "rdp probe \u00b7 port 6990 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "6990",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6990"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7085,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "860a0dcaf86324366eda6b862a8da4d0754fc5ad",
    "event_fingerprint": "639e9a3f6f35a891706c644dd179abeeba5c9a31",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 7085,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "acec2faef3dbe4eb5289d9195889808b0c37e2ad",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7085
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 7085 \u00b7 (sonde \/ probe)",
    "target_port_label": "7085",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7085,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7085
        },
        "attack_vector": "rdp probe \u00b7 port 7085 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7085",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7085"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:7056",
        "port:7085",
        "port:8251",
        "port:8797"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7056,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "aa6686d97ed51aa0d500bdb4aafef8818fafc14e",
    "event_fingerprint": "8354fe2f6e7967778a02d6774b501082aef18b62",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 7056,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0c6696b41fcd180f9fa7779751f5a7a658b3f680",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7056
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 7056 \u00b7 (sonde \/ probe)",
    "target_port_label": "7056",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7056,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7056
        },
        "attack_vector": "rdp probe \u00b7 port 7056 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7056",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7056"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:11064",
        "port:7056",
        "port:8251",
        "port:8797"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8251,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "c99a5624423bc3ce9105dbdc11f1de867266031a",
    "event_fingerprint": "bae5533870785272ea9d4e4fb408a2afbf5d49c4",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8251,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "87ba4164397a0245a450de60ff9f9867aae740b4",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8251
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8251 \u00b7 (sonde \/ probe)",
    "target_port_label": "8251",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8251,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8251
        },
        "attack_vector": "rdp probe \u00b7 port 8251 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8251",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8251"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "port:11064",
        "port:11583",
        "port:12552",
        "port:8251",
        "port:8350",
        "port:8797"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8797,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "da1c925a50c4331a856124bf5dfb63d4e5587225",
    "event_fingerprint": "2d714f4c0ae17ca03ae96f2b52434319eaa80b07",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8797,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "67d7f399138feda23ffdabc3969017e4790094be",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8797
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8797 \u00b7 (sonde \/ probe)",
    "target_port_label": "8797",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8797,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8797
        },
        "attack_vector": "rdp probe \u00b7 port 8797 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8797",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8797"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:11064",
        "port:11583",
        "port:12552",
        "port:8350",
        "port:8797"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 11064,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bcc978ebde52471fa331a99fac104d7769032b01",
    "event_fingerprint": "ba6850625074c91e20ba3883602838273fb09774",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 11064,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "513f919646242ac6383eddcaa74d8bac24119b84",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 11064
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 11064 \u00b7 (sonde \/ probe)",
    "target_port_label": "11064",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11064,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 11064
        },
        "attack_vector": "rdp probe \u00b7 port 11064 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "11064",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11064"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:11064",
        "port:11583",
        "port:12552",
        "port:8350"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 12552,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "606299f60d1094fb62c8af38638d76419e3c868c",
    "event_fingerprint": "23ecd81e3aac589f94a6ca832164552c5ddfa7f9",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 12552,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f13e87171a08043d1e2b3cb661a160ecf6968a4d",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 12552
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 12552 \u00b7 (reconnaissance)",
    "target_port_label": "12552",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 12552,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 12552
        },
        "attack_vector": "port scan syn \u00b7 port 12552 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "12552",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "12552"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:11583",
        "port:12552",
        "port:8350"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8350,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "44e9a871968eba7cea23b02bc5fce2a135a67533",
    "event_fingerprint": "a5fec823731cc05ae894216ff8a00f65fd57d1d9",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8350,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "274c8245d5036ff79dbec7f2ec28f904a3c31c19",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8350
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8350 \u00b7 (sonde \/ probe)",
    "target_port_label": "8350",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8350,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8350
        },
        "attack_vector": "rdp probe \u00b7 port 8350 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8350",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8350"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:11583",
        "port:8350"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 11583,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "356d562a1bb9940c639a6f24ae41683380306d07",
    "event_fingerprint": "2f832a4f7b96858ed724b04d72e59c57ef2e9528",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 11583,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fcdca9e20ebcce324241f4cdfcb97c290c5374ba",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 11583
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 11583 \u00b7 (sonde \/ probe)",
    "target_port_label": "11583",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11583,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 11583
        },
        "attack_vector": "rdp probe \u00b7 port 11583 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "11583",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11583"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 4354,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e405f2d6799c7a38669fa55054e7b27b3131a056",
    "event_fingerprint": "466a5cda0b5e519c6ef923e629a2eeb9b80b2343",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 4354,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b204381d953c57d87e3abebb0bd940c45a0b6749",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 4354
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 4354 \u00b7 (sonde \/ probe)",
    "target_port_label": "4354",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4354,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 4354
        },
        "attack_vector": "rdp probe \u00b7 port 4354 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "4354",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4354"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:2119",
        "port:2382",
        "port:3095",
        "port:4354"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 3095,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "496a932e7aac82c7242e918a03cc502a5f7a7ac7",
    "event_fingerprint": "00b6fe21ba4de7a0096b3474b8bef80339a6e085",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 3095,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e496f3b5513453c9c48edbfd87dafe42441537a9",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3095
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 3095 \u00b7 (sonde \/ probe)",
    "target_port_label": "3095",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3095,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3095
        },
        "attack_vector": "rdp probe \u00b7 port 3095 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "3095",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3095"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:2119",
        "port:2382",
        "port:3095"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 2119,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "a6d5a184be54d6d926a9e8ac1151db8b6cd8c66f",
    "event_fingerprint": "fed9f7b5d0a6d318691d944afaa3b8a479464568",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 2119,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "05186e8fb29975657389f5184030e2e56bddd762",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 2119
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 2119 \u00b7 (sonde \/ probe)",
    "target_port_label": "2119",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2119,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 2119
        },
        "attack_vector": "rdp probe \u00b7 port 2119 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "2119",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2119"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:2119",
        "port:2382",
        "port:5197",
        "port:948"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 2382,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f84bd078f759761da7db49c37931e5807bb13543",
    "event_fingerprint": "a2c62c9d89c2e33fde1537874598503d48abff20",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 2382,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e9c591f4c61f80d1d0759dbbaedb7026d6aa444a",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 2382
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 2382 \u00b7 (sonde \/ probe)",
    "target_port_label": "2382",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2382,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 2382
        },
        "attack_vector": "rdp probe \u00b7 port 2382 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "2382",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2382"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:2382",
        "port:5197",
        "port:948"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "well_known",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 948,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4cd7f4cb47a0db16d210ed2c1f083f9c74e5823b",
    "event_fingerprint": "48d724ad7e6dd5eb8877f294181cb4d61e63358c",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 948,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "02645b0d7340d75ed5885b530c1a4a09dcd4fef8",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 948
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 948 \u00b7 (sonde \/ probe)",
    "target_port_label": "948",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 948,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 948
        },
        "attack_vector": "rdp probe \u00b7 port 948 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "948",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "948"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:2849",
        "port:5035",
        "port:5197",
        "port:6227",
        "port:948"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 5197,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4018683ed531f6b246672f3280342d1eba9888af",
    "event_fingerprint": "85a8d205c94a40da9b10a599c03b0089e6288e2f",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 5197,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6b31ac1e1dede748830847952cb6f36a9e992ec0",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 5197
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 5197 \u00b7 (sonde \/ probe)",
    "target_port_label": "5197",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 5197,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 5197
        },
        "attack_vector": "rdp probe \u00b7 port 5197 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "5197",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "5197"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:2849",
        "port:5035",
        "port:5197",
        "port:6227"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 6227,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "88601b0cf0ed8bbbaf07e3fb8ed4ebf2134bd12b",
    "event_fingerprint": "16b7c05243eefdc41b2cfa976945076f693e8698",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 6227,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2e6d2f3f8322f54898832f21a22b93e8128b0cc5",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 6227
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 6227 \u00b7 (sonde \/ probe)",
    "target_port_label": "6227",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6227,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 6227
        },
        "attack_vector": "rdp probe \u00b7 port 6227 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "6227",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6227"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:2849",
        "port:3347",
        "port:5035",
        "port:6227"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 2849,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "ae07486074b2effb9be6b5c1fb5eb52cc67cb66b",
    "event_fingerprint": "71e88f3264da40eb6095c13e537e0349a10748e2",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 2849,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "045c82a3adda95bb75ab28c5d698f5acd57b1224",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 2849
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 2849 \u00b7 (sonde \/ probe)",
    "target_port_label": "2849",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2849,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 2849
        },
        "attack_vector": "rdp probe \u00b7 port 2849 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "2849",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2849"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:2849",
        "port:3347",
        "port:5035",
        "sap-diag"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 5035,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2d78b067a3246e30c897eac7e0df6a3419ce2e24",
    "event_fingerprint": "de4fef3e86a6993fa2426eeb7ee36600273ed544",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 5035,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1530674e96bce03a69d1de48525c6c25e82eb724",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 5035
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 5035 \u00b7 (sonde \/ probe)",
    "target_port_label": "5035",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 5035,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 5035
        },
        "attack_vector": "rdp probe \u00b7 port 5035 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "5035",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "5035"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:3347",
        "port:5035",
        "sap-diag"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 3347,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "7861323e5921032850b9aa0980644bc8349c8884",
    "event_fingerprint": "1d35342af00e56e23022bd105672562d67402015",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 3347,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5ce29c1647f1aeb54c2c6f74375aa2b2ea32f01c",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3347
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 3347 \u00b7 (sonde \/ probe)",
    "target_port_label": "3347",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3347,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3347
        },
        "attack_vector": "rdp probe \u00b7 port 3347 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "3347",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3347"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:3347",
        "sap-diag"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 215929,
    "country": "NL",
    "dst_port": 3294,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b37a5f329712b0dec7a41293ba2d7fa2e069e08e",
    "event_fingerprint": "ed4676f8053c7418df7c5674b02b5df3178f546b",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 3294,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "117bae1b1dde22fad58a1a9a73fcb47777aa8e45",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3294,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 via SAP Diag:3294 \u00b7 (sonde \/ probe)",
    "target_port_label": "3294 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via SAP Diag",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3294,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3294,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "rdp probe \u00b7 via SAP Diag:3294 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "3294 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3294"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "00000000534150000000000000000000000000",
    "emulator_response_len": 19,
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": "sap-diag",
    "app_proto": "sap-diag",
    "asn": 215929,
    "country": "NL",
    "dst_port": 3248,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "f4c78708daf7261f6b49a0a1c516431c53e4e0a8",
    "event_fingerprint": "501a4b0f5d9a1a030d5d7f9c0ec7ea06e6d31e1c",
    "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "sap-diag",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 3248,
        "service": "sap-diag",
        "service_name": "sap-diag",
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "76bc36d21655c297096a21bde450b3b82e965373",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3248,
        "service": "sap-diag",
        "service_label_fr": "SAP Diag"
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 via SAP Diag:3248 \u00b7 (sonde \/ probe)",
    "target_port_label": "3248 \u00b7 SAP Diag",
    "emulator_service": "sap-diag",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
        "classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via SAP Diag \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "sap-diag",
        "service_label_fr": "SAP Diag",
        "dst_port": 3248,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-diag",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3248,
            "service": "sap-diag",
            "service_label_fr": "SAP Diag"
        },
        "attack_vector": "rdp probe \u00b7 via SAP Diag:3248 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "3248 \u00b7 SAP Diag",
        "emulator_service": "sap-diag",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_diag",
        "service_banner": "honeypot-sap-diag",
        "service_os": "linux",
        "dst_port": "3248"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 8,
    "multi_protocol_sample": [
        "port:3465",
        "port:4779",
        "port:5364",
        "port:5447",
        "port:5919",
        "port:6413",
        "sap-diag",
        "sap-ms"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_sap_diag_probe",
        "sap_diag_emulated",
        "sap_diag_payload",
        "sap_diag_probe"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 3465,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1d7a52de8b07347cfae48fa9fb3ee351a259a54c",
    "event_fingerprint": "5d893d483c969fb288f8a4ce2c0890f3d6320e12",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 3465,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c9d528dbfb5e98c418608a18172dfa9badad1b59",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3465
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 3465 \u00b7 (sonde \/ probe)",
    "target_port_label": "3465",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (7 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3465,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3465
        },
        "attack_vector": "rdp probe \u00b7 port 3465 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "3465",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3465"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 7,
    "multi_protocol_sample": [
        "port:3465",
        "port:4779",
        "port:5364",
        "port:5447",
        "port:5919",
        "port:6413",
        "sap-ms"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": "sap-ms",
    "app_proto": "sap-ms",
    "asn": 215929,
    "country": "NL",
    "dst_port": 3699,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 38,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "3836ca1626066d89876329eb572439e36d21de24",
    "event_fingerprint": "55761d5eb7334cf3b7d01a69caa44f71b007a90c",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 38,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "sap-ms",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 3699,
        "service": "sap-ms",
        "service_name": "sap-ms",
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d91b970d8cefe5b7a17c1de5b9b15af5f5a103d9",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 3699,
        "service": "sap-ms",
        "service_label_fr": "SAP Message Server"
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 via SAP Message Server:3699 \u00b7 (sonde \/ probe)",
    "target_port_label": "3699 \u00b7 SAP Message Server",
    "emulator_service": "sap-ms",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via SAP Message Server \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 38,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "sap-ms",
        "service_label_fr": "SAP Message Server",
        "dst_port": 3699,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-ms",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 3699,
            "service": "sap-ms",
            "service_label_fr": "SAP Message Server"
        },
        "attack_vector": "rdp probe \u00b7 via SAP Message Server:3699 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "3699 \u00b7 SAP Message Server",
        "emulator_service": "sap-ms",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_ms",
        "service_banner": "honeypot-sap-ms",
        "service_os": "linux",
        "dst_port": "3699"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "port:4779",
        "port:5364",
        "port:5447",
        "port:5919",
        "port:6413",
        "sap-ms"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_sap_message_server",
        "sap_message_server"
    ]
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 5447,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "7d8272df5bf37f3a3998f49e353495b30da9e5f5",
    "event_fingerprint": "9aed68e66c24cadb7048723cb421b532571e7b95",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 5447,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b22d729bfcc7268d4cf82f94dfe5b45e2fdf7050",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 5447
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 5447 \u00b7 (sonde \/ probe)",
    "target_port_label": "5447",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 5447,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 5447
        },
        "attack_vector": "rdp probe \u00b7 port 5447 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "5447",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "5447"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:4779",
        "port:5364",
        "port:5447",
        "port:5919",
        "port:6413"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 5919,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "4d24472d3df93bcf0f8e5cc1e7a90bee709888aa",
    "event_fingerprint": "d1f60436fa76a9e0beb63f97b9decd3f2196811f",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 5919,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "297e0a6d08278c9cf31c03d03aaf6597403d01d0",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 5919
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 5919 \u00b7 (reconnaissance)",
    "target_port_label": "5919",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 5919,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 5919
        },
        "attack_vector": "port scan syn \u00b7 port 5919 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "5919",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "5919"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:4779",
        "port:5364",
        "port:5919",
        "port:6413"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 6413,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "19bd4763918bb0bad89294a5243492f411bf22a2",
    "event_fingerprint": "4177624b737026d88bac193fd51f191feadf184f",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 6413,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "639fb0516c674bcdabe4d78c435af417f72e3b28",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 6413
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 6413 \u00b7 (sonde \/ probe)",
    "target_port_label": "6413",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6413,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 6413
        },
        "attack_vector": "rdp probe \u00b7 port 6413 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "6413",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6413"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:4779",
        "port:5364",
        "port:6413"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 4779,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "ab3cbe8adcd98e230eac198ab81c19e77d9bcdb9",
    "event_fingerprint": "744a7481216a65a080a23f90af08f35d202f2a79",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 4779,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5bdfa37bf2ab529a6d699acc20a0b0bbb9c1aaba",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 4779
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 4779 \u00b7 (sonde \/ probe)",
    "target_port_label": "4779",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4779,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 4779
        },
        "attack_vector": "rdp probe \u00b7 port 4779 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "4779",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4779"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:4779",
        "port:5364"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}