62.164.177.54

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 30182,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "5411eab32e5cb35383f2ffe641fe9a2fb9a4727f",
    "event_fingerprint": "d37ab6c02e3ce18e92eea7145f53dc3a298a397c",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 30182,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "64c7883f4f7ccbc73d39ffb9cc92f4b7492c4fe8",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 30182
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 30182 \u00b7 (sonde \/ probe)",
    "target_port_label": "30182",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 30182,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 30182
        },
        "attack_vector": "rdp probe \u00b7 port 30182 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "30182",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "30182"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "port:28311",
        "port:28377",
        "port:28590",
        "port:29442",
        "port:30182",
        "port:31288"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 31288,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "016b3beebe7238e405f5d534ee1975b5e8dfe28d",
    "event_fingerprint": "56e6632273563d85a6e37f9c2edd430b2c973e29",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 31288,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4bc57c2319cd7c7c90a6c3a7ca59d6494c9f70d0",
    "protocol_details": {
        "port": 31288
    },
    "attack_vector": "Sonde port \u00b7 port 31288 \u00b7 (sonde \/ probe)",
    "target_port_label": "31288",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 31288,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 31288
        },
        "attack_vector": "Sonde port \u00b7 port 31288 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "31288",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "31288"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "port:28311",
        "port:28377",
        "port:28590",
        "port:29442",
        "port:29676",
        "port:31288"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 29442,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "b39ecff5b80948e16f2552544a54fe46af252296",
    "event_fingerprint": "d1ba41fa9eb26e78a2c5465a469175ab9bc37a27",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 29442,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9c9e08befb4bf0df9d255dedf72c0e23ce76da66",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 29442
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 29442 \u00b7 (reconnaissance)",
    "target_port_label": "29442",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 29442,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 29442
        },
        "attack_vector": "port scan syn \u00b7 port 29442 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "29442",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "29442"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "port:28311",
        "port:28377",
        "port:28590",
        "port:29442",
        "port:29552",
        "port:29676"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 28311,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "529bdce6774068037030213102ec74ba3f71c1d1",
    "event_fingerprint": "cba1a4d573d08cb9d4414cd39a597d89f96524ad",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 28311,
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5587635c8ac3f72fb52bda6885ff710c72f10311",
    "protocol_details": {
        "port": 28311
    },
    "attack_vector": "Sonde port \u00b7 port 28311 \u00b7 (sonde \/ probe)",
    "target_port_label": "28311",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 28311,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 28311
        },
        "attack_vector": "Sonde port \u00b7 port 28311 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "28311",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "28311"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:28311",
        "port:28377",
        "port:28590",
        "port:29552",
        "port:29676"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 28377,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "21762d286ecccfd72278f7646d93420fe593963c",
    "event_fingerprint": "276a178b635ee4c5af71a96cc7ae7ef7553959f5",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 28377,
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "307fe5bdb5c09526fa5725f91a7dad2ea231ec62",
    "protocol_details": {
        "port": 28377
    },
    "attack_vector": "Sonde port \u00b7 port 28377 \u00b7 (sonde \/ probe)",
    "target_port_label": "28377",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 28377,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 28377
        },
        "attack_vector": "Sonde port \u00b7 port 28377 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "28377",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "28377"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:28377",
        "port:28590",
        "port:29552",
        "port:29676"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 28590,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bb9eb694ea8213637caf7800bb08af0044fb9889",
    "event_fingerprint": "9fbce6db848e20f770ad797ef4cb5f359aad761f",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 28590,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "47285b30a8f026c137b3576eaea4504e8304821c",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 28590
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 28590 \u00b7 (sonde \/ probe)",
    "target_port_label": "28590",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 28590,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 28590
        },
        "attack_vector": "rdp probe \u00b7 port 28590 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "28590",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "28590"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:28590",
        "port:29552",
        "port:29676"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 29676,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "908382b1128fedde209e401802f7b10b57b3d3fc",
    "event_fingerprint": "6460d10bbb9361fc3b41f94e6cf015e0225d59c1",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 29676,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "85b1cc03c0f92da4a23494e1f82abcdd7f8202ae",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 29676
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 29676 \u00b7 (sonde \/ probe)",
    "target_port_label": "29676",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 29676,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 29676
        },
        "attack_vector": "rdp probe \u00b7 port 29676 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "29676",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "29676"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:29552",
        "port:29676"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 29552,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "7b4488ee39d8f09b9a5d05d0a7a8d81541678be4",
    "event_fingerprint": "2c154dfc555bf3e4a89b04e2e23c578fad7579d2",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 29552,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8f049b140eed7de03bfe69fb1147db56ad44b5d9",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 29552
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 29552 \u00b7 (sonde \/ probe)",
    "target_port_label": "29552",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 29552,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 29552
        },
        "attack_vector": "rdp probe \u00b7 port 29552 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "29552",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "29552"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:29552",
        "port:31368"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 31368,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "8b9e998ed64f98dc7f7f2fa173e2bf7b6412398d",
    "event_fingerprint": "24367b9ab3c71002f1e8bb7baa1a69854c65b1ce",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 31368,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c3387e67434e1580c239ba260eda61a9ea6fa18c",
    "protocol_details": {
        "port": 31368
    },
    "attack_vector": "Sonde port \u00b7 port 31368 \u00b7 (sonde \/ probe)",
    "target_port_label": "31368",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 31368,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 31368
        },
        "attack_vector": "Sonde port \u00b7 port 31368 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "31368",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "31368"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 13045,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "af5052b128cbaed6865530086f52096786996898",
    "event_fingerprint": "f43b5ad0f94e144e76d222fab1986ea687bbb189",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 13045,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "99ed681b66e21505073ae69f0372d2a4408fb813",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 13045
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 13045 \u00b7 (sonde \/ probe)",
    "target_port_label": "13045",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 13045,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 13045
        },
        "attack_vector": "rdp probe \u00b7 port 13045 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "13045",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "13045"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:13045",
        "port:13794",
        "port:18099"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 13794,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "52ee1fff9dbb214c382ecc0a7827ace91ebc914f",
    "event_fingerprint": "c39733631b6c9b62dadce536569cce5cd848ee54",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 13794,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "eed4a3f8b70c8e1f80a958288afbcc1d7d9f4c0f",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 13794
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 13794 \u00b7 (sonde \/ probe)",
    "target_port_label": "13794",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 13794,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 13794
        },
        "attack_vector": "rdp probe \u00b7 port 13794 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "13794",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "13794"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:13794",
        "port:18099"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 18099,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "703ee392277539315281b84d0fc8e58fa5665a02",
    "event_fingerprint": "81160d9faa4b734944d068a794f4fc4c9f6a14b7",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 18099,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0028433d6ed4cafcca6c69ecc58250b46ebd6d65",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 18099
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 18099 \u00b7 (sonde \/ probe)",
    "target_port_label": "18099",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 18099,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 18099
        },
        "attack_vector": "rdp probe \u00b7 port 18099 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "18099",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "18099"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 17468,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "666fbf5f3ddaf64f298e29d8e05d3a1fa8a3f42d",
    "event_fingerprint": "4c3acf24075ceaa056bcb2b407374be35bfd7dab",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 17468,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "aea365669eb935bc172d53cee1ead84033bbe32c",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 17468
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 17468 \u00b7 (sonde \/ probe)",
    "target_port_label": "17468",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 17468,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 17468
        },
        "attack_vector": "rdp probe \u00b7 port 17468 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "17468",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "17468"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:14592",
        "port:17468",
        "port:17776"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 14592,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "8886803f6577228c2643d3f83b2b6e7fe9ebb68d",
    "event_fingerprint": "b5f0d0d3f3ec9d24125ca1f5a39eba4d309b2a92",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 14592,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a20f67ffcc814390e77203af9fdfe473920752c7",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 14592
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 14592 \u00b7 (sonde \/ probe)",
    "target_port_label": "14592",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 14592,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 14592
        },
        "attack_vector": "rdp probe \u00b7 port 14592 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "14592",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "14592"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:14592",
        "port:17776",
        "port:18507"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 17776,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "820c51dc82e788001e2c281fa905f02adf997cf1",
    "event_fingerprint": "4e955c52ab5a3c968c0149ad5674722a4604118e",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 17776,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4d9aa04e6daccc7b2d6364ee44f9ad76d36c30a2",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 17776
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 17776 \u00b7 (sonde \/ probe)",
    "target_port_label": "17776",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 17776,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 17776
        },
        "attack_vector": "rdp probe \u00b7 port 17776 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "17776",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "17776"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:13525",
        "port:17776",
        "port:18507"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 18507,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "9bbf172b1fa96b8993e1bbc4387c6670ee98b311",
    "event_fingerprint": "a8a66a9e20aae0f0e5deada56287dc1de7dfe473",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 18507,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2aa9852cd3ffb4a82fced103a36243ab36297043",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 18507
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 18507 \u00b7 (sonde \/ probe)",
    "target_port_label": "18507",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 18507,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 18507
        },
        "attack_vector": "rdp probe \u00b7 port 18507 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "18507",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "18507"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:13525",
        "port:18507"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 13525,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "af782306149aaf3510c9b579d9ec6d01423d57fd",
    "event_fingerprint": "8b15837bda5a8209a983b4d6e12e5fac24972b5b",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 13525,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8a53bbcc561751d28be59d04d2f83adf3d91a209",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 13525
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 13525 \u00b7 (sonde \/ probe)",
    "target_port_label": "13525",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 13525,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 13525
        },
        "attack_vector": "rdp probe \u00b7 port 13525 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "13525",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "13525"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 18721,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "443febb7da952f524a3f742d558754dc430298e2",
    "event_fingerprint": "5e2941861c0f7fc2071a48334ffc4c3bb350c4d4",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 18721,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d6d058a60479337e99bf944f1325a6d8c4644bb6",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 18721
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 18721 \u00b7 (sonde \/ probe)",
    "target_port_label": "18721",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 18721,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 18721
        },
        "attack_vector": "rdp probe \u00b7 port 18721 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "18721",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "18721"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:14442",
        "port:15597",
        "port:18721",
        "port:19157"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 14442,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "650753085f3d254a50c8004e9ba6fbae4ae07cb7",
    "event_fingerprint": "df3707822dbce11c11313686e551fc5948359b42",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 14442,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cfff8d7ab5f99a2a6b0d4de21865682060de5cff",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 14442
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 14442 \u00b7 (sonde \/ probe)",
    "target_port_label": "14442",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 14442,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 14442
        },
        "attack_vector": "rdp probe \u00b7 port 14442 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "14442",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "14442"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:14442",
        "port:15597",
        "port:19157"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 19157,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bef25391a6671f9b195810fc516ce324f0e05e38",
    "event_fingerprint": "aaad314d1be77adf795c39449a6f67c2106e64a9",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 19157,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9e804f0dddd014f28c03cfca58d1bae1ef21d714",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 19157
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 19157 \u00b7 (sonde \/ probe)",
    "target_port_label": "19157",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 19157,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 19157
        },
        "attack_vector": "rdp probe \u00b7 port 19157 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "19157",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "19157"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:15597",
        "port:19157"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 15597,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "487ed54530ca77c21aeef4a51624eb60b9b34657",
    "event_fingerprint": "ec6b5dc309a14faa2b7470dc9ad452309d1b8c65",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 15597,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e6619cd52b6fc12480202e8cbcce4b11447fe397",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 15597
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 15597 \u00b7 (sonde \/ probe)",
    "target_port_label": "15597",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 15597,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 15597
        },
        "attack_vector": "rdp probe \u00b7 port 15597 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "15597",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "15597"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:15597",
        "port:7336",
        "port:8024",
        "port:9239"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7336,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "460d75c94f97bfcadc640b64aa5bd26f98b50de4",
    "event_fingerprint": "2e6f32eda3a260079ed90b7585efc0e9c9c3e98d",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 7336,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f04cdab21f53f598ee12f89cb27e2db88c2855b7",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7336
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 7336 \u00b7 (sonde \/ probe)",
    "target_port_label": "7336",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (10 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7336,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7336
        },
        "attack_vector": "rdp probe \u00b7 port 7336 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7336",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7336"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 10,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:11410",
        "port:7034",
        "port:7192",
        "port:7336"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8024,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "0f1e0ae88e6a733f0e7892a3c69d422ecb6f1e81",
    "event_fingerprint": "3d47ee473243b8acb39ab111603a3863c4f2753d",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8024,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "60f346fadcd01c485bdac22eb057b8df8315081b",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8024
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8024 \u00b7 (sonde \/ probe)",
    "target_port_label": "8024",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8024,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8024
        },
        "attack_vector": "rdp probe \u00b7 port 8024 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8024",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8024"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:11410",
        "port:7034",
        "port:7192",
        "port:8024"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 9239,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "104be7e089414a9203fe6ed27141d0afb10ed1c4",
    "event_fingerprint": "2ac0ac48620825072e2454a2cb64eb0e895798f7",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 9239,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4c57e1511ce522f6fdf479f4d3fd966f6a6d0fba",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 9239
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 9239 \u00b7 (sonde \/ probe)",
    "target_port_label": "9239",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9239,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 9239
        },
        "attack_vector": "rdp probe \u00b7 port 9239 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "9239",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9239"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 8,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:11410",
        "port:7034",
        "port:7192",
        "port:9239"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7034,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "241d08c1293dd04e39ef4b6653a5970761899657",
    "event_fingerprint": "cef38ab106dd58616b684d0635ec665a100b0de6",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 7034,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3659df09e7c4c1a2328af857c91df1438725287b",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7034
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 7034 \u00b7 (sonde \/ probe)",
    "target_port_label": "7034",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (7 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7034,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7034
        },
        "attack_vector": "rdp probe \u00b7 port 7034 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7034",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7034"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 7,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:11410",
        "port:7034",
        "port:7192"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 11410,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e1a756220c255c1e247bd315dd3b608b79e79b87",
    "event_fingerprint": "64807ad57af7168c8235a23932abce1b015ee875",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 11410,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "59b098729dbdb6c43f924ecc72f5281654a7995e",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 11410
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 11410 \u00b7 (reconnaissance)",
    "target_port_label": "11410",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11410,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 11410
        },
        "attack_vector": "port scan syn \u00b7 port 11410 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "11410",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11410"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:11410",
        "port:7192"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 11130,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "aee1c1fd84a5e0de7fcf22829a426e7062e12b2a",
    "event_fingerprint": "49ab5e1b667824992b16abd7902430f032cf220a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 11130,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c45216d6a4c1268a43f4b2719ea6f250abfff152",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 11130
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 11130 \u00b7 (reconnaissance)",
    "target_port_label": "11130",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11130,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 11130
        },
        "attack_vector": "port scan syn \u00b7 port 11130 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "11130",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11130"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        7192,
        10073,
        11130,
        11216
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:10073",
        "port:10653",
        "port:11130",
        "port:11216",
        "port:7192"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 10073,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "52fd6fd9405f84a073ae5654656be87f57a4cf16",
    "event_fingerprint": "ef6a402bb0e8e82e933a881c7c3688f62ade995e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 10073,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "28b7f470918ac56d2315e4f5e633c486ad78cf81",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 10073
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 10073 \u00b7 (reconnaissance)",
    "target_port_label": "10073",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 10073,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 10073
        },
        "attack_vector": "port scan syn \u00b7 port 10073 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "10073",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "10073"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        7192,
        10073,
        10653,
        11216
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:10073",
        "port:10111",
        "port:10653",
        "port:11216",
        "port:7192"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7192,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1d9dae1140abe66b70eb6d0949930b0e4fa49c48",
    "event_fingerprint": "bebc8ae4d74a689f12f97adcbb97f0ee5b85acef",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 7192,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "debc477a5ed30764d8a6a487ed3983d7217d3ad9",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7192
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 7192 \u00b7 (reconnaissance)",
    "target_port_label": "7192",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7192,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7192
        },
        "attack_vector": "port scan syn \u00b7 port 7192 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7192",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7192"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:10111",
        "port:10653",
        "port:11216",
        "port:6544",
        "port:7192"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 11216,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "c67b1ed4533058feb63495dfb0d18b9dc12f939a",
    "event_fingerprint": "75fbf3abb0167f893590d7a3a6f4e3902839e7b9",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 11216,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "512b5e9eeff2f4e10d30e90a7526153dc2ca82e0",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 11216
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 11216 \u00b7 (sonde \/ probe)",
    "target_port_label": "11216",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11216,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 11216
        },
        "attack_vector": "rdp probe \u00b7 port 11216 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "11216",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11216"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:10111",
        "port:10653",
        "port:11216",
        "port:6544"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 10653,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "e08eebd3f0ea0dacba04ae93f258bd128b3b5877",
    "event_fingerprint": "daa0d12f0e7f36781ebca5690420b09a5bad6f1f",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 10653,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3974e34896a3ed4afa8b278ec2b1dac014710d0a",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 10653
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 10653 \u00b7 (sonde \/ probe)",
    "target_port_label": "10653",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 10653,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 10653
        },
        "attack_vector": "rdp probe \u00b7 port 10653 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "10653",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "10653"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:10111",
        "port:10653",
        "port:6544"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 10111,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "c29ddad6125f9be6eb5a250175b31f18d8600399",
    "event_fingerprint": "db0dad471b2570baf4e8d85c997edd145a019578",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 10111,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6c7c572dc53b87cf7e84f9104f581b02a049ba35",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 10111
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 10111 \u00b7 (reconnaissance)",
    "target_port_label": "10111",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 10111,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 10111
        },
        "attack_vector": "port scan syn \u00b7 port 10111 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "10111",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "10111"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "port:10111",
        "port:6544",
        "port:7378",
        "port:8068",
        "port:8593",
        "port:9434"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 6544,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "b6cbcc898567514aca5db7fa9dea014b4b825150",
    "event_fingerprint": "44bb6cb370753e242f731204e60b0041d3ccddb1",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 6544,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6501f6477c309322fdb326693067df923e78a716",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 6544
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 6544 \u00b7 (sonde \/ probe)",
    "target_port_label": "6544",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6544,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 6544
        },
        "attack_vector": "rdp probe \u00b7 port 6544 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "6544",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6544"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:6544",
        "port:7378",
        "port:8068",
        "port:8593",
        "port:9434"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7378,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "b5253bb9e05ea8818d2bde42f22305b98b73c905",
    "event_fingerprint": "47bac2de5af2a0f8e22d3fc13c966ed4c3a47d72",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 7378,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "18b5eafb2e898419bf97e95c517e08b01703b353",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7378
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 7378 \u00b7 (sonde \/ probe)",
    "target_port_label": "7378",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7378,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7378
        },
        "attack_vector": "rdp probe \u00b7 port 7378 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7378",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7378"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:6990",
        "port:7378",
        "port:8068",
        "port:8593",
        "port:9434"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 9434,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "997a5150930afac546e7802ec8eb277624d098c4",
    "event_fingerprint": "63a82d9afa19aa64cbf20f66f4044a4c1b9186a8",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 9434,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d342aab96f0593e001568f786abfaffb3d43f25b",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 9434
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 9434 \u00b7 (sonde \/ probe)",
    "target_port_label": "9434",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9434,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 9434
        },
        "attack_vector": "rdp probe \u00b7 port 9434 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "9434",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9434"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:6990",
        "port:8068",
        "port:8593",
        "port:9434"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8593,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f032dfcfdd1519d35fd6e829313435d758cd3c60",
    "event_fingerprint": "8935df2a256181c2e445ba3410fdac6131096b97",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8593,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a45899f5fcea9e7a4b8dc95c0c23ead239a2b0ff",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8593
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8593 \u00b7 (sonde \/ probe)",
    "target_port_label": "8593",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8593,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8593
        },
        "attack_vector": "rdp probe \u00b7 port 8593 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8593",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8593"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:6990",
        "port:8068",
        "port:8593"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8068,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "1f251610e84324762e45ac94ef694fbfee2785bb",
    "event_fingerprint": "f405c3b1706ffffc78131946ad5ad738c84c6b87",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8068,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4513f1dc45f16004224ee2119a7ae7ca0b1f1db7",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8068
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8068 \u00b7 (sonde \/ probe)",
    "target_port_label": "8068",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8068,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8068
        },
        "attack_vector": "rdp probe \u00b7 port 8068 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8068",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8068"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:6990",
        "port:8068"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 6990,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "2fc3712237def8a58a9498c003f6b9ac77182945",
    "event_fingerprint": "0d4109b085834f3f3b5d619c8e37857010d39c72",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 6990,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fc23a4c15f1ac077c632dd822c671fb8acbb1fc4",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 6990
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 6990 \u00b7 (sonde \/ probe)",
    "target_port_label": "6990",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 %",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6990,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 6990
        },
        "attack_vector": "rdp probe \u00b7 port 6990 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "6990",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6990"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7085,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "860a0dcaf86324366eda6b862a8da4d0754fc5ad",
    "event_fingerprint": "639e9a3f6f35a891706c644dd179abeeba5c9a31",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 7085,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "acec2faef3dbe4eb5289d9195889808b0c37e2ad",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7085
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 7085 \u00b7 (sonde \/ probe)",
    "target_port_label": "7085",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7085,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7085
        },
        "attack_vector": "rdp probe \u00b7 port 7085 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7085",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7085"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:7056",
        "port:7085",
        "port:8251",
        "port:8797"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 7056,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "aa6686d97ed51aa0d500bdb4aafef8818fafc14e",
    "event_fingerprint": "8354fe2f6e7967778a02d6774b501082aef18b62",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 7056,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0c6696b41fcd180f9fa7779751f5a7a658b3f680",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 7056
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 7056 \u00b7 (sonde \/ probe)",
    "target_port_label": "7056",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 7056,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 7056
        },
        "attack_vector": "rdp probe \u00b7 port 7056 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "7056",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "7056"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:11064",
        "port:7056",
        "port:8251",
        "port:8797"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8251,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "c99a5624423bc3ce9105dbdc11f1de867266031a",
    "event_fingerprint": "bae5533870785272ea9d4e4fb408a2afbf5d49c4",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8251,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "87ba4164397a0245a450de60ff9f9867aae740b4",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8251
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8251 \u00b7 (sonde \/ probe)",
    "target_port_label": "8251",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8251,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8251
        },
        "attack_vector": "rdp probe \u00b7 port 8251 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8251",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8251"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "port:11064",
        "port:11583",
        "port:12552",
        "port:8251",
        "port:8350",
        "port:8797"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8797,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "da1c925a50c4331a856124bf5dfb63d4e5587225",
    "event_fingerprint": "2d714f4c0ae17ca03ae96f2b52434319eaa80b07",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8797,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "67d7f399138feda23ffdabc3969017e4790094be",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8797
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8797 \u00b7 (sonde \/ probe)",
    "target_port_label": "8797",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (5 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8797,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8797
        },
        "attack_vector": "rdp probe \u00b7 port 8797 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8797",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8797"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "port:11064",
        "port:11583",
        "port:12552",
        "port:8350",
        "port:8797"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 11064,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bcc978ebde52471fa331a99fac104d7769032b01",
    "event_fingerprint": "ba6850625074c91e20ba3883602838273fb09774",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 11064,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "513f919646242ac6383eddcaa74d8bac24119b84",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 11064
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 11064 \u00b7 (sonde \/ probe)",
    "target_port_label": "11064",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (4 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11064,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 11064
        },
        "attack_vector": "rdp probe \u00b7 port 11064 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "11064",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11064"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "port:11064",
        "port:11583",
        "port:12552",
        "port:8350"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 12552,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "606299f60d1094fb62c8af38638d76419e3c868c",
    "event_fingerprint": "23ecd81e3aac589f94a6ca832164552c5ddfa7f9",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 12552,
        "risk_score": 42
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f13e87171a08043d1e2b3cb661a160ecf6968a4d",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 12552
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "port scan syn \u00b7 port 12552 \u00b7 (reconnaissance)",
    "target_port_label": "12552",
    "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 12552,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 12552
        },
        "attack_vector": "port scan syn \u00b7 port 12552 \u00b7 (reconnaissance)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "12552",
        "emulator_service": null,
        "confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "12552"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "port:11583",
        "port:12552",
        "port:8350"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 47,
    "payload_entropy": 4.155132734426204,
    "port_category": "registered",
    "org": "Data Campus Limited",
    "service": null,
    "app_proto": null,
    "asn": 215929,
    "country": "NL",
    "dst_port": 8350,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "44e9a871968eba7cea23b02bc5fce2a135a67533",
    "event_fingerprint": "a5fec823731cc05ae894216ff8a00f65fd57d1d9",
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 116,
    "precision_signals": [
        "pat-0347",
        "pat-0348"
    ],
    "kb_rule_ids": [
        "pat-0347",
        "pat-0348"
    ],
    "matched_patterns": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "matched_pattern_names": [
        "RDP NTLM hash",
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake"
    ],
    "pattern_ids": [
        "pat-0347",
        "pat-0348",
        "pat-0868",
        "pat-0554"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "NL",
        "asn": 215929,
        "org": "Data Campus Limited",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "012fca15d97ce99638a1c3f4bf953d2b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 8350,
        "risk_score": 50
    },
    "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "274c8245d5036ff79dbec7f2ec28f904a3c31c19",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
        "port": 8350
    },
    "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
    "attack_vector": "rdp probe \u00b7 port 8350 \u00b7 (sonde \/ probe)",
    "target_port_label": "8350",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 8350,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0347",
            "pat-0348"
        ],
        "tags_summary_labels_fr": [
            "pat-0347",
            "pat-0348"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\/*\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000",
            "port": 8350
        },
        "attack_vector": "rdp probe \u00b7 port 8350 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/*\ufffdCookie: mstshash=Administr",
        "target_port_label": "8350",
        "emulator_service": null,
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "8350"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "port:11583",
        "port:8350"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate"
}