62.210.142.165

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 258,
    "payload_entropy": 5.90721168183675,
    "port_category": "registered",
    "org": "Scaleway SAS",
    "service": "http-alt-8880",
    "app_proto": "http-alt-8880",
    "asn": 12876,
    "country": "FR",
    "dst_port": 8880,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "a678a325f39f135d725fa17d8a0ab23c974128d7",
    "event_fingerprint": "cd275046284c79b2c8b267829c0a7456b4c77905",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 14
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8880",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "106c8e564e7599294ac1f616981e8229",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 8880,
        "service": "http-alt-8880",
        "service_name": "http-alt-8880",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0003o&`\ufffd\u001d\u0006\ufffd\\\ufffd\ufffdx\ufffd\u001e\ufffdl}\ufffd\f\ufffdo\ufffdo<\ufffd\ufffdM7k\ufffd \ufffd\ufffd\ufffd\ufffd\u0004\ufffdI\ufffd\ufffd\u07d71V\u0176\u0006S\ufffd=B\u0015;\ufffdy&\ufffd\ufffdQ\ufffdK\t\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0003o&`\ufffd\u001d\u0006\ufffd\\\ufffd\ufffdx\ufffd\u001e\ufffdl}\ufffd\f\ufffdo\ufffdo<\ufffd\ufffdM7k\ufffd \ufffd\ufffd\ufffd\ufffd\u0004\ufffdI\ufffd\ufffd\u07d71V\u0176\u0006S\ufffd=B\u0015;\ufffdy&\ufffd\ufffdQ\ufffdK\t\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 |\ufffd\ufffdJ\u001c\u0004\ufffd^2\ufffdU!3\ufffdFt\ufffd\ufffd\u0014\u058f\ufffd\ufffd`j\ufffd\ufffd4o\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0003o&`\ufffd\u001d\u0006\ufffd\\\ufffd\ufffdx\ufffd\u001e\ufffdl}\ufffd\f\ufffdo\ufffdo<\ufffd\ufffdM7k\ufffd \ufffd\ufffd\ufffd\ufffd\u0004\ufffdI\ufffd\ufffd\u07d71V\u0176\u0006S\ufffd=B\u0015;\ufffdy&\ufffd\ufffdQ\ufffdK\t\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c981ddd8fd3037996bd1877770e635ae3571d382",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0003o&`\ufffd\u001d\u0006\ufffd\\\ufffd\ufffdx\ufffd\u001e\ufffdl}\ufffd\f\ufffdo\ufffdo<\ufffd\ufffdM7k\ufffd \ufffd\ufffd\ufffd\ufffd\u0004\ufffdI\ufffd\ufffd\u07d71V\u0176\u0006S\ufffd=B\u0015;\ufffdy&\ufffd\ufffdQ\ufffdK\t\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "port": 8880,
        "service": "http-alt-8880",
        "service_label_fr": "HTTP ALT 8880"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffdo&`\ufffd\ufffd\\\ufffd\ufffdx\ufffd\ufffdl}\ufffd\ufffdo\ufffdo<\ufffd\ufffdM7k\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\u07d71V\u0176S\ufffd=B;\ufffdy&\ufffd\ufffdQ\ufffdK\t&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "port scan syn \u00b7 via HTTP ALT 8880:8880 \u00b7 (reconnaissance)",
    "target_port_label": "8880 \u00b7 HTTP ALT 8880",
    "emulator_service": "http-alt-8880",
    "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 8880 \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 14
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http-alt-8880",
        "service_label_fr": "HTTP ALT 8880",
        "dst_port": 8880,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8880",
        "correlation_flags": [
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +14",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\u0003o&`\ufffd\u001d\u0006\ufffd\\\ufffd\ufffdx\ufffd\u001e\ufffdl}\ufffd\f\ufffdo\ufffdo<\ufffd\ufffdM7k\ufffd \ufffd\ufffd\ufffd\ufffd\u0004\ufffdI\ufffd\ufffd\u07d71V\u0176\u0006S\ufffd=B\u0015;\ufffdy&\ufffd\ufffdQ\ufffdK\t\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "port": 8880,
            "service": "http-alt-8880",
            "service_label_fr": "HTTP ALT 8880"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP ALT 8880:8880 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffdo&`\ufffd\ufffd\\\ufffd\ufffdx\ufffd\ufffdl}\ufffd\ufffdo\ufffdo<\ufffd\ufffdM7k\ufffd \ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\u07d71V\u0176S\ufffd=B;\ufffdy&\ufffd\ufffdQ\ufffdK\t&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "8880 \u00b7 HTTP ALT 8880",
        "emulator_service": "http-alt-8880",
        "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +14",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8880",
        "service_banner": "honeypot-http-alt-8880",
        "service_os": "linux",
        "dst_port": "8880"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 7,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        8880,
        25461
    ],
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 14,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_clienthello"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 176,
    "payload_entropy": 5.190700614951268,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "c9fffb34d7ddcda6df13a078737742f64b39ebda",
    "event_fingerprint": "07c2e34c387abbfda66641cb2930ea384bc92b9a",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "d01862bc02ef46777e0d2beffe107933",
        "path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genome",
    "method": "GET",
    "path": "\/login",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/login HTTP\/1.1",
    "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genome",
    "evidence": {
        "method": "GET",
        "path": "\/login",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/login HTTP\/1.1",
        "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genome",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7d79d9082ebd3013f2a32fed8d0ebf6cf7933a8d",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/login",
        "request_line": "GET \/login HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genome",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/login",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/login",
            "request_line": "GET \/login HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/login",
        "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genome",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.08,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "http_probe_login"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 176,
    "payload_entropy": 5.187915245657671,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 55,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "fd4c5b2a8e3d71f2e7450101eb4114f2a980dfdc",
    "event_fingerprint": "2eaf18ca16ad2699ec0fc242a88c9838fd2f9979",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 55,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "49e1dbc1e1dd88e1e3ec6c457c8bf132",
        "path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genome",
    "method": "GET",
    "path": "\/login",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/login HTTP\/1.1",
    "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genome",
    "evidence": {
        "method": "GET",
        "path": "\/login",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/login HTTP\/1.1",
        "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genome",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a16174648a9a3795b05564062b96696c9d049ce1",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/login",
        "request_line": "GET \/login HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genome",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/login",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 55,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/login",
            "request_line": "GET \/login HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/login",
        "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genome",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.07,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "http_probe_login",
        "net_web_probe"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 84
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "94cbd295967620830d1ac8eefc3dab9ec7f6dbc6",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 185,
    "payload_entropy": 5.205981733830235,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 59,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "2454e342f96ad5ecf12334ce2f3cc6f54c8ce7f2",
    "event_fingerprint": "a8443d7c4fa603ab3e50a5ab0cd43de43172900e",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 59,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "476e9f7acecdc17e9fb8de5200d6bd80",
        "path_pattern_hash": "a7598671652528e5b3f1e930e03e0a00"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 59
    },
    "payload_preview": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c",
    "method": "GET",
    "path": "\/doc\/index.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/doc\/index.html HTTP\/1.1",
    "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c",
    "evidence": {
        "method": "GET",
        "path": "\/doc\/index.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/doc\/index.html HTTP\/1.1",
        "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f22265189f4259aad5ae0e4761f39401c89674b2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/doc\/index.html",
        "request_line": "GET \/doc\/index.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/doc\/index.html",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 59,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 59,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/doc\/index.html",
            "request_line": "GET \/doc\/index.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/doc\/index.html",
        "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.06,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "94cbd295967620830d1ac8eefc3dab9ec7f6dbc6",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 185,
    "payload_entropy": 5.2033318689887595,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "b2cea41dbb40fb9bdb8e7530983d3d02772e3db6",
    "event_fingerprint": "8f0a1c56164b6bcab7999c2a7f0258329df3d52d",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 60,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "bf539a7cd96ad07f8e7e25ab2a2ceb78",
        "path_pattern_hash": "a7598671652528e5b3f1e930e03e0a00"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c",
    "method": "GET",
    "path": "\/doc\/index.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/doc\/index.html HTTP\/1.1",
    "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c",
    "evidence": {
        "method": "GET",
        "path": "\/doc\/index.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/doc\/index.html HTTP\/1.1",
        "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ee331ce34c95eafd7546010796356d6f723f4102",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/doc\/index.html",
        "request_line": "GET \/doc\/index.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/doc\/index.html",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 60,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/doc\/index.html",
            "request_line": "GET \/doc\/index.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/doc\/index.html",
        "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.04,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "907a2da0c21f11374cb55d43385e76e234aedbef",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 183,
    "payload_entropy": 5.163644118730148,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "e090173f579d7bf7a0c9954c7cffaaaa76d32f27",
    "event_fingerprint": "4854d0333624caff949566a304e0d33687c2d9d9",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0721",
        "pat-0803",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CVE-2024-21762 FortiOS",
        "MITRE T1210 remote svc",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0721",
        "pat-0803",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 60,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "4495dbfd281ca0c8d508cd8c480ade11",
        "path_pattern_hash": "3e486ce7203b6fa4cdeca113b89969b2"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com",
    "method": "GET",
    "path": "\/remote\/login",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/remote\/login HTTP\/1.1",
    "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com",
    "evidence": {
        "method": "GET",
        "path": "\/remote\/login",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/remote\/login HTTP\/1.1",
        "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7c9f36acd68763c50685a44017845f90623c05ed",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/remote\/login",
        "request_line": "GET \/remote\/login HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/remote\/login",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 60,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/remote\/login",
            "request_line": "GET \/remote\/login HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/remote\/login",
        "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.03,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_vpn_portal_scan"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": null,
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "907a2da0c21f11374cb55d43385e76e234aedbef",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 183,
    "payload_entropy": 5.16096529361718,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "6aee3b1c8c621905a148bca0e9fc3c25d2c49c61",
    "event_fingerprint": "74631a3b20881558f4b13e252835244368d5e2f2",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0721",
        "pat-0803",
        "pat-0103"
    ],
    "matched_pattern_names": [
        "CVE-2024-21762 FortiOS",
        "MITRE T1210 remote svc",
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0721",
        "pat-0803",
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 60,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "ff631774cb26d3bee59b23f7255fe1a6",
        "path_pattern_hash": "3e486ce7203b6fa4cdeca113b89969b2"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com",
    "method": "GET",
    "path": "\/remote\/login",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/remote\/login HTTP\/1.1",
    "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com",
    "evidence": {
        "method": "GET",
        "path": "\/remote\/login",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/remote\/login HTTP\/1.1",
        "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "eca642dc36c8a5e59ca3585dcae59fb674d7fe01",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/remote\/login",
        "request_line": "GET \/remote\/login HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/remote\/login",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 60,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/remote\/login",
            "request_line": "GET \/remote\/login HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/remote\/login",
        "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.01,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_vpn_portal_scan",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "asp",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "74ee0e33710b439680e8c9dc84b7100d7e7738f2",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 186,
    "payload_entropy": 5.182184882857123,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "32bf6c946d801a84ff1eb9889f9ba46983a75aa7",
    "event_fingerprint": "eb7889447874cf9f440826ceeb3731cd91a530e2",
    "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103",
        "pat-0854",
        "pat-0341",
        "pat-0237",
        "pat-0606"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass",
        "ET Magento admin",
        "ES admin GET",
        "Probe \/admin\/login",
        "ActiveMQ console"
    ],
    "pattern_ids": [
        "pat-0103",
        "pat-0854",
        "pat-0341",
        "pat-0237",
        "pat-0606"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "4031a553e44c25bdafd4376005a82edf",
        "path_pattern_hash": "742c42cda425189da92779d492183288"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.",
    "method": "GET",
    "path": "\/admin\/login.asp",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/admin\/login.asp HTTP\/1.1",
    "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.",
    "evidence": {
        "method": "GET",
        "path": "\/admin\/login.asp",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/admin\/login.asp HTTP\/1.1",
        "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.",
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c3ae82bd3f2b55e7011bd177a8c179c18ce2324a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/admin\/login.asp",
        "request_line": "GET \/admin\/login.asp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/login.asp",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/admin\/login.asp",
            "request_line": "GET \/admin\/login.asp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/login.asp",
        "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.01,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_admin_panel_probe",
        "http_admin_panel_scan",
        "http_probe_admin",
        "http_sensitive_path"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "asp",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "74ee0e33710b439680e8c9dc84b7100d7e7738f2",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 186,
    "payload_entropy": 5.179549264600816,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 9,
    "anomaly_count": 0,
    "campaign_key": "f8cfda37939c73435b535d651d0407ea3d4f07f1",
    "event_fingerprint": "79ec3a5e60cfbd5c66b1b4ff8e907f26272e0316",
    "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103",
        "pat-0854",
        "pat-0341",
        "pat-0237",
        "pat-0606"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass",
        "ET Magento admin",
        "ES admin GET",
        "Probe \/admin\/login",
        "ActiveMQ console"
    ],
    "pattern_ids": [
        "pat-0103",
        "pat-0854",
        "pat-0341",
        "pat-0237",
        "pat-0606"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "e530c5eb2381b0b999957fba9ef5f169",
        "path_pattern_hash": "742c42cda425189da92779d492183288"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.",
    "method": "GET",
    "path": "\/admin\/login.asp",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/admin\/login.asp HTTP\/1.1",
    "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.",
    "evidence": {
        "method": "GET",
        "path": "\/admin\/login.asp",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/admin\/login.asp HTTP\/1.1",
        "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.",
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cfe2cbb8702982e45baf8be2a6200d5b48dbf8dd",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/admin\/login.asp",
        "request_line": "GET \/admin\/login.asp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/login.asp",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/admin\/login.asp",
            "request_line": "GET \/admin\/login.asp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/login.asp",
        "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.99,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_admin_panel_probe",
        "http_admin_panel_scan",
        "http_probe_admin",
        "http_sensitive_path",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "be2a319b834b23bb5db3b9088093e167eb951dfe",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 175,
    "payload_entropy": 5.196291258129574,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 59,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "2454e342f96ad5ecf12334ce2f3cc6f54c8ce7f2",
    "event_fingerprint": "eb5ba5e2fe18e615e49829fee897a4cc01e62099",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 59,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "06d87c87f695da60e56782b9c767487e",
        "path_pattern_hash": "d10f26a614111c156a22417b020f287c"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 59
    },
    "payload_preview": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomec",
    "method": "GET",
    "path": "\/web\/",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/web\/ HTTP\/1.1",
    "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomec",
    "evidence": {
        "method": "GET",
        "path": "\/web\/",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/web\/ HTTP\/1.1",
        "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomec",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "98a17c40bd9793cda42f8527aa9ce4207c1d7cbe",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/web\/",
        "request_line": "GET \/web\/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomec",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/web\/",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 59,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 59,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/web\/",
            "request_line": "GET \/web\/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/web\/",
        "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomec",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.99,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "be2a319b834b23bb5db3b9088093e167eb951dfe",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 175,
    "payload_entropy": 5.193489972440014,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "b2cea41dbb40fb9bdb8e7530983d3d02772e3db6",
    "event_fingerprint": "330378562173af41eedc948c04e0d13b1e5c7897",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 60,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "8d5ed463b5195409666633d1639fb47c",
        "path_pattern_hash": "d10f26a614111c156a22417b020f287c"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomec",
    "method": "GET",
    "path": "\/web\/",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/web\/ HTTP\/1.1",
    "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomec",
    "evidence": {
        "method": "GET",
        "path": "\/web\/",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/web\/ HTTP\/1.1",
        "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomec",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "221888ea768177ee2946b555629010f527b01848",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/web\/",
        "request_line": "GET \/web\/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomec",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/web\/",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 60,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/web\/",
            "request_line": "GET \/web\/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/web\/",
        "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomec",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.97,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "3557966eb4cf90eaeaf0c2c998dc2912f0a3d646",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 190,
    "payload_entropy": 5.183788285736035,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 59,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "2454e342f96ad5ecf12334ce2f3cc6f54c8ce7f2",
    "event_fingerprint": "c4e5a4f1e6e32ee6a3f71921dae36a4b854f6239",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 59,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "0003c8de0e4c2e4d8a6cf334d2f92f64",
        "path_pattern_hash": "048ac28c307da42b70c2a2400dc8fdcb"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 59
    },
    "payload_preview": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no",
    "method": "GET",
    "path": "\/webpages\/login.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/webpages\/login.html HTTP\/1.1",
    "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no",
    "evidence": {
        "method": "GET",
        "path": "\/webpages\/login.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/webpages\/login.html HTTP\/1.1",
        "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "634881e563d6b23e06426fe4771d0ed35d55a9ff",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/webpages\/login.html",
        "request_line": "GET \/webpages\/login.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/webpages\/login.html",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 59,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 59,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/webpages\/login.html",
            "request_line": "GET \/webpages\/login.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/webpages\/login.html",
        "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.96,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "3557966eb4cf90eaeaf0c2c998dc2912f0a3d646",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 190,
    "payload_entropy": 5.181208154179861,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "b2cea41dbb40fb9bdb8e7530983d3d02772e3db6",
    "event_fingerprint": "216b1491d07adc7bc7c0cad8d357766690718961",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 60,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "f1ac9496bcc930ba4bf51607226b7dba",
        "path_pattern_hash": "048ac28c307da42b70c2a2400dc8fdcb"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no",
    "method": "GET",
    "path": "\/webpages\/login.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/webpages\/login.html HTTP\/1.1",
    "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no",
    "evidence": {
        "method": "GET",
        "path": "\/webpages\/login.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/webpages\/login.html HTTP\/1.1",
        "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6239f20bdf064902e2574174ac9b3e7b96b62833",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/webpages\/login.html",
        "request_line": "GET \/webpages\/login.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/webpages\/login.html",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 60,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/webpages\/login.html",
            "request_line": "GET \/webpages\/login.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/webpages\/login.html",
        "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.95,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 182,
    "payload_entropy": 5.209622730736457,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eebebb9621a37171397af4bd47060432c60398cd",
    "event_fingerprint": "f5e498e9ffe6b8313b09c8d0d6d540149e850233",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.68,
    "classification_confidence": 0.68,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 49,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "b50e7eb8fd71ffd2cead81ff53082ddd",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 49
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "62f3749d0d5698f2756385c454f82291f241cf17",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 68,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 49,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 49,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.94,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600",
    "emulator_response_len": 130,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 182,
    "payload_entropy": 5.206929186804187,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 49,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "bb97435c8401b0be42dcb2d3008f87f2e964933a",
    "event_fingerprint": "33636069ed8fad357698ac0befbec2186370ead0",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.68,
    "classification_confidence": 0.68,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 49,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "3c936d0e9d7d1ecb832216ddb62903cf",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 49
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre": "TA0043",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1dc58fc54ca6cedf66f66ee1bf46c5147aa28d81",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 68 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 68,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 49,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 49,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0043",
        "mitre_technique": "TA0043",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.93,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": null,
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "1d98e547275d79a259c88ab2179d7a5b45136091",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.166342611700201,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "e7791c7625a95702d77a11225a08e1fcd77b077e",
    "event_fingerprint": "304a51d8319da7144ee79a9f1f1271951bebabc6",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 60,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "77478afebc9511d1799477fa15bb90f3",
        "path_pattern_hash": "c9092f743328565e59631a2a8c600c06"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n",
    "method": "GET",
    "path": "\/manage\/account\/login",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/manage\/account\/login HTTP\/1.1",
    "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n",
    "evidence": {
        "method": "GET",
        "path": "\/manage\/account\/login",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/manage\/account\/login HTTP\/1.1",
        "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b17b3d7355e35c37829cf9c7a0b4bc2c5dc747b2",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/manage\/account\/login",
        "request_line": "GET \/manage\/account\/login HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/manage\/account\/login",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 60,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/manage\/account\/login",
            "request_line": "GET \/manage\/account\/login HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/manage\/account\/login",
        "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 0.81,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_admin_panel_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 3,
    "http_path_ext": null,
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "1d98e547275d79a259c88ab2179d7a5b45136091",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 191,
    "payload_entropy": 5.163775988686206,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "4e23045c268c25fd50d2c526c6db77ceadd55f2f",
    "event_fingerprint": "288bd0bd843ef9432d37bd614ffef36adbf9d8c3",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 60,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "1bb12a708f94ba6bc85c4d4e5f345303",
        "path_pattern_hash": "c9092f743328565e59631a2a8c600c06"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n",
    "method": "GET",
    "path": "\/manage\/account\/login",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/manage\/account\/login HTTP\/1.1",
    "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n",
    "evidence": {
        "method": "GET",
        "path": "\/manage\/account\/login",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/manage\/account\/login HTTP\/1.1",
        "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6dcb4706f82f71f83b999c24e779f57adae5f718",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/manage\/account\/login",
        "request_line": "GET \/manage\/account\/login HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/manage\/account\/login",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 60,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/manage\/account\/login",
            "request_line": "GET \/manage\/account\/login HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/manage\/account\/login",
        "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 0.81,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_admin_panel_probe",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "4b0fa2b11fff9aad6a33a18fa912997e85ee3d7a",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 187,
    "payload_entropy": 5.207692355789157,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.5,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "32bf6c946d801a84ff1eb9889f9ba46983a75aa7",
    "event_fingerprint": "73aa793f99c5f657d6f7a66e32791f404c39a007",
    "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103",
        "pat-0854",
        "pat-0341",
        "pat-0606"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass",
        "ET Magento admin",
        "ES admin GET",
        "ActiveMQ console"
    ],
    "pattern_ids": [
        "pat-0103",
        "pat-0854",
        "pat-0341",
        "pat-0606"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "bb9b4168268e7a375b0d06eae47fed01",
        "path_pattern_hash": "f654a37a97b7cd890ed6641ca011c363"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia",
    "method": "GET",
    "path": "\/admin\/index.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/admin\/index.html HTTP\/1.1",
    "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia",
    "evidence": {
        "method": "GET",
        "path": "\/admin\/index.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/admin\/index.html HTTP\/1.1",
        "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia",
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "de74b2d14c9ec938bbe72c66be2111e7954acb49",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/admin\/index.html",
        "request_line": "GET \/admin\/index.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/index.html",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/admin\/index.html",
            "request_line": "GET \/admin\/index.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/index.html",
        "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 0.8,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_admin_panel_probe",
        "http_admin_panel_scan",
        "http_probe_admin",
        "http_sensitive_path"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "4b0fa2b11fff9aad6a33a18fa912997e85ee3d7a",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 187,
    "payload_entropy": 5.205070831748125,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 9,
    "anomaly_count": 0,
    "campaign_key": "f8cfda37939c73435b535d651d0407ea3d4f07f1",
    "event_fingerprint": "fc3a899f5c8762e78ad7f80dee5e4ace516fbe7f",
    "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103",
        "pat-0854",
        "pat-0341",
        "pat-0606"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass",
        "ET Magento admin",
        "ES admin GET",
        "ActiveMQ console"
    ],
    "pattern_ids": [
        "pat-0103",
        "pat-0854",
        "pat-0341",
        "pat-0606"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "f8fc420cf08f519bc0ceabb859a48b30",
        "path_pattern_hash": "f654a37a97b7cd890ed6641ca011c363"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia",
    "method": "GET",
    "path": "\/admin\/index.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/admin\/index.html HTTP\/1.1",
    "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia",
    "evidence": {
        "method": "GET",
        "path": "\/admin\/index.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/admin\/index.html HTTP\/1.1",
        "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia",
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2d873bc97152a28d95cf76211d156a48d3260921",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/admin\/index.html",
        "request_line": "GET \/admin\/index.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/index.html",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/admin\/index.html",
            "request_line": "GET \/admin\/index.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/admin\/index.html",
        "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.29,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_admin_panel_probe",
        "http_admin_panel_scan",
        "http_probe_admin",
        "http_sensitive_path",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "14fe4559026d4c5b5eb530ee70300c52d99e70d7",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 181,
    "payload_entropy": 5.216056594817208,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eebebb9621a37171397af4bd47060432c60398cd",
    "event_fingerprint": "a897a25f708c56f6d933517370c7d05fbae74720",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "290e26aeaf3aa27c7c4ab56619fcad44",
        "path_pattern_hash": "213456c5dc963e03ec1f27600c46c954"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "method": "GET",
    "path": "\/index.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/index.html HTTP\/1.1",
    "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "evidence": {
        "method": "GET",
        "path": "\/index.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/index.html HTTP\/1.1",
        "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cade17b0bc0b68ac95f5df23d3641f49b7a47d65",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/index.html",
        "request_line": "GET \/index.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.html",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/index.html",
            "request_line": "GET \/index.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.html",
        "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.27,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "14fe4559026d4c5b5eb530ee70300c52d99e70d7",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 181,
    "payload_entropy": 5.213348169426749,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "bb97435c8401b0be42dcb2d3008f87f2e964933a",
    "event_fingerprint": "e90a213130e94a2f210e0e15111b6b1ed62326fc",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "57edd389216a6613b8f3148f50483e8d",
        "path_pattern_hash": "213456c5dc963e03ec1f27600c46c954"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "method": "GET",
    "path": "\/index.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/index.html HTTP\/1.1",
    "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "evidence": {
        "method": "GET",
        "path": "\/index.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/index.html HTTP\/1.1",
        "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f31463198e139b6fb542b8491800d375877478bf",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/index.html",
        "request_line": "GET \/index.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.html",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/index.html",
            "request_line": "GET \/index.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/index.html",
        "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.25,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "2febb8a3c3d7f366eb236521e1eaa73748bc008b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 189,
    "payload_entropy": 5.257958529737969,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 59,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "2454e342f96ad5ecf12334ce2f3cc6f54c8ce7f2",
    "event_fingerprint": "67f809e1e92a14be38b12b5f99c47e2ebf8f4f03",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 59,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "88fe732383dbcdb0adda96ab3d7c33af",
        "path_pattern_hash": "822b93c1de9180d86276e796ab5bb039"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 59
    },
    "payload_preview": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok",
    "method": "GET",
    "path": "\/+CSCOE+\/logon.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1",
    "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok",
    "evidence": {
        "method": "GET",
        "path": "\/+CSCOE+\/logon.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1",
        "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2baf411fc49aaf5bb65e2e88a5c46574055b1524",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/+CSCOE+\/logon.html",
        "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/+CSCOE+\/logon.html",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 59,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 59,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/+CSCOE+\/logon.html",
            "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/+CSCOE+\/logon.html",
        "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.24,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "2febb8a3c3d7f366eb236521e1eaa73748bc008b",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 189,
    "payload_entropy": 5.255364746692081,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 60,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "b2cea41dbb40fb9bdb8e7530983d3d02772e3db6",
    "event_fingerprint": "99dccb0c21c755b2870e1612f35486d891644664",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 60,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "598bca0a696bdb30f7dde0868f854aca",
        "path_pattern_hash": "822b93c1de9180d86276e796ab5bb039"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 60
    },
    "payload_preview": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok",
    "method": "GET",
    "path": "\/+CSCOE+\/logon.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1",
    "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok",
    "evidence": {
        "method": "GET",
        "path": "\/+CSCOE+\/logon.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1",
        "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8aab759580442fd135ac6661218c4830e8ff0a53",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/+CSCOE+\/logon.html",
        "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/+CSCOE+\/logon.html",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 60,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 60,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/+CSCOE+\/logon.html",
            "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/+CSCOE+\/logon.html",
        "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.21,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "cgi",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "4ed67956bf1afbdf7ecfacd9a5462fa4568ad191",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 188,
    "payload_entropy": 5.172996380082122,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 6.1,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 7,
    "anomaly_count": 0,
    "campaign_key": "e1cfe25bf409ebd7ca7479d8137f688c0a7fbeb5",
    "event_fingerprint": "3638f8fec16d0261d89ca213c5a4f04d097794f1",
    "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "01e239de6b675bf7d33facc25c76931b",
        "path_pattern_hash": "0254f935cc3e30d1c750bc16ae1de8fe"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki",
    "method": "GET",
    "path": "\/cgi-bin\/login.cgi",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1",
    "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki",
    "evidence": {
        "method": "GET",
        "path": "\/cgi-bin\/login.cgi",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1",
        "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki",
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "61a11d0447061be6547cc6d27708b295cf5b878e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/cgi-bin\/login.cgi",
        "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/cgi-bin\/login.cgi",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/cgi-bin\/login.cgi",
            "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/cgi-bin\/login.cgi",
        "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.21,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_cgi_bin",
        "http_sensitive_path",
        "iot_http_endpoint"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 2,
    "http_path_ext": "cgi",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "4ed67956bf1afbdf7ecfacd9a5462fa4568ad191",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 188,
    "payload_entropy": 5.1703888003179035,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 100,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.8,
    "risk_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 61,
    "tag_count": 8,
    "anomaly_count": 0,
    "campaign_key": "27466bec7de08e7965088c33f61a76c53edb6d2b",
    "event_fingerprint": "3dd45593401fbf5a316ace97d9b6486cb0e487a7",
    "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 100,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 61,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "83d35cb78af4d01f1bcdd4a7bb782ab8",
        "path_pattern_hash": "0254f935cc3e30d1c750bc16ae1de8fe"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 61
    },
    "payload_preview": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki",
    "method": "GET",
    "path": "\/cgi-bin\/login.cgi",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1",
    "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki",
    "evidence": {
        "method": "GET",
        "path": "\/cgi-bin\/login.cgi",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950468:nosqli-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1",
        "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki",
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "654ecc5d3c934d142bc9e4fa9f20a916e8d8142b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/cgi-bin\/login.cgi",
        "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/cgi-bin\/login.cgi",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 100,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 61,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 61,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/cgi-bin\/login.cgi",
            "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/cgi-bin\/login.cgi",
        "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.18,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950468:nosqli-3",
        "950470:nosqli-3",
        "http_probe_cgi_bin",
        "http_sensitive_path",
        "iot_http_endpoint",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "htm",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "a080cb0dd1e1d6f0c7467b3267535b1479975617",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 180,
    "payload_entropy": 5.193052331431029,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eebebb9621a37171397af4bd47060432c60398cd",
    "event_fingerprint": "6ecde5361ca450984254dd46d245030edf26c562",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "897ab447a52bc18d1eb1460275490338",
        "path_pattern_hash": "8d9104962905da3abf94ae1977aa5733"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "method": "GET",
    "path": "\/login.htm",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/login.htm HTTP\/1.1",
    "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "evidence": {
        "method": "GET",
        "path": "\/login.htm",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/login.htm HTTP\/1.1",
        "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9142ebd78f86ed980fcbee7deb04d724b99dfe55",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/login.htm",
        "request_line": "GET \/login.htm HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.htm",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/login.htm",
            "request_line": "GET \/login.htm HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.htm",
        "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.17,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "htm",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "a080cb0dd1e1d6f0c7467b3267535b1479975617",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 180,
    "payload_entropy": 5.190328859232845,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "bb97435c8401b0be42dcb2d3008f87f2e964933a",
    "event_fingerprint": "4c350604991a73b9e04dfebeb801debdfe7be9bf",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "183a8c38d245bd945f51a1534d10512f",
        "path_pattern_hash": "8d9104962905da3abf94ae1977aa5733"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "method": "GET",
    "path": "\/login.htm",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/login.htm HTTP\/1.1",
    "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "evidence": {
        "method": "GET",
        "path": "\/login.htm",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/login.htm HTTP\/1.1",
        "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "392a1128fe4036c9db17e5edc1ecceaab1d01549",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/login.htm",
        "request_line": "GET \/login.htm HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.htm",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/login.htm",
            "request_line": "GET \/login.htm HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.htm",
        "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.15,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "58165cf539b8f3baebb7b0688b61c0c6bd9c1221",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 181,
    "payload_entropy": 5.190863306244353,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "eebebb9621a37171397af4bd47060432c60398cd",
    "event_fingerprint": "4593749b303fb407f05790d8c77c553754935aef",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "5abbb44b9fde72866e3ce911d1782f80",
        "path_pattern_hash": "4bd05a9ef933daa96fd6cd3e76e0cd59"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "method": "GET",
    "path": "\/login.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/login.html HTTP\/1.1",
    "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "evidence": {
        "method": "GET",
        "path": "\/login.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/login.html HTTP\/1.1",
        "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "40d8fcfa62138c576a7087f11694c85de92a75dd",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/login.html",
        "request_line": "GET \/login.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.html",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/login.html",
            "request_line": "GET \/login.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.html",
        "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.14,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "html",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "58165cf539b8f3baebb7b0688b61c0c6bd9c1221",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 181,
    "payload_entropy": 5.188154880853894,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 54,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "bb97435c8401b0be42dcb2d3008f87f2e964933a",
    "event_fingerprint": "9cf7da00068dd371ad496393620b0d70488c1deb",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 54,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "b0b6119dedfa3317179b7a01d56e5396",
        "path_pattern_hash": "4bd05a9ef933daa96fd6cd3e76e0cd59"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 54
    },
    "payload_preview": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "method": "GET",
    "path": "\/login.html",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/login.html HTTP\/1.1",
    "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "evidence": {
        "method": "GET",
        "path": "\/login.html",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/login.html HTTP\/1.1",
        "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8e384009d1a7c071ef8c540ab3c34fde40196de1",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/login.html",
        "request_line": "GET \/login.html HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.html",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 54,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 54,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/login.html",
            "request_line": "GET \/login.html HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.html",
        "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/g",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.12,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "jsp",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "b41f25730b5d6fa1c33072bb9c8d43aa7ba33e8e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 180,
    "payload_entropy": 5.208679603610511,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 55,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "c9fffb34d7ddcda6df13a078737742f64b39ebda",
    "event_fingerprint": "0e73dce2dfa6958a4ca8b11297147bb57b401881",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 55,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "513743f94224bac9f37af5f5c2f8cbd8",
        "path_pattern_hash": "b16b806d2fba9e3fd94bdb22d055d68f"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "method": "GET",
    "path": "\/login.jsp",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/login.jsp HTTP\/1.1",
    "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "evidence": {
        "method": "GET",
        "path": "\/login.jsp",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/login.jsp HTTP\/1.1",
        "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8398013a926a85379f420394e4b54fb22c44065b",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/login.jsp",
        "request_line": "GET \/login.jsp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.jsp",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 55,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/login.jsp",
            "request_line": "GET \/login.jsp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.jsp",
        "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.11,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "http_probe_login"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "jsp",
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "b41f25730b5d6fa1c33072bb9c8d43aa7ba33e8e",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 180,
    "payload_entropy": 5.205956131412328,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 84,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25
    },
    "risk_score": 55,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "fd4c5b2a8e3d71f2e7450101eb4114f2a980dfdc",
    "event_fingerprint": "af10712b608a39dbf15ef372c2d3783e7d07c3a5",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 25,
        "risk_score": 55,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "eaeba31ea770e27e03465d349233af0c",
        "path_pattern_hash": "b16b806d2fba9e3fd94bdb22d055d68f"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 55
    },
    "payload_preview": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "method": "GET",
    "path": "\/login.jsp",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/login.jsp HTTP\/1.1",
    "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "evidence": {
        "method": "GET",
        "path": "\/login.jsp",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/login.jsp HTTP\/1.1",
        "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "633999588af34f6dbe60d730240ac5965d0ac158",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/login.jsp",
        "request_line": "GET \/login.jsp HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.jsp",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 25,
            "risk_score": 55,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 55,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/login.jsp",
            "request_line": "GET \/login.jsp HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance) \u00b7 \u2192 \/login.jsp",
        "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/ge",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +18 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 1.09,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "http_probe_login",
        "net_web_probe"
    ]
}

{
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "29631142709d39bee607e41cbb81ae54d3741f51",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 171,
    "payload_entropy": 5.20021676838609,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 96,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 96,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 58,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "9c378e52467691600f5848987ea4fc017d28817b",
    "event_fingerprint": "f61c7fe1381ed868f1d3c73648a597b50cad5236",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 96,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 58,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "c99d99d0b8900298ef2c59ac9048f013",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 85,
        "service": "http",
        "service_name": "http",
        "risk_score": 58
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawl",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawl",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawl",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5498011d7a2a642d829d1d27416a8175850d2ed3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 85,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawl",
    "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance)",
    "target_port_label": "85 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 96,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 58,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 58,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 85,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:85 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:85\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawl",
        "target_port_label": "85 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 0.62,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 4,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2",
    "http_host_hash": "f257870e26046e30cbd03e9d5726ca53aa58b86f",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 171,
    "payload_entropy": 5.197349955545897,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http",
    "app_proto": "http",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 96,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 96,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25
    },
    "risk_score": 58,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "c0d4db67e02d617f50b8f675ce4051d1a72189b9",
    "event_fingerprint": "dc548988a809f1697c51218198b1d9a5eaa2cace",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0103"
    ],
    "matched_pattern_names": [
        "LFI Double-dot bypass"
    ],
    "pattern_ids": [
        "pat-0103"
    ],
    "confidence_breakdown": {
        "waf": 96,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 25,
        "risk_score": 58,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be",
        "payload_hash": "b124ae6ede5f4f7d427be21519ca3815",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http",
        "service_name": "http",
        "risk_score": 58
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawl",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawl",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawl",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "df412e8e1858bab75f44e43a6e1228d4765a2369",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
        "port": 81,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawl",
    "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance)",
    "target_port_label": "81 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 58\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (9 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 96,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 25,
            "risk_score": 58,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 58,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)",
            "port": 81,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP:81 \u00b7 (reconnaissance)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:81\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawl",
        "target_port_label": "81 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +18 \u00b7 4 tag(s) WAF",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 0.82,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 9,
    "multi_protocol_sample": [
        "http",
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_web_probe"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "tls_ja3_hash": "7c1e207beb00684bbbe144f1b0abe1d5",
    "tls_sni": null,
    "tls_weak_cipher": true,
    "tls_weak_cipher_count": 4,
    "tls_alpn": [
        "http\/1.1"
    ],
    "bytes_in": 258,
    "payload_entropy": 5.901290574931201,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "tls",
    "app_proto": "tls",
    "asn": 12876,
    "country": "FR",
    "dst_port": 85,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 6,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "31a047642b29cfbe29d3a33bc466b99d2bddbb3d",
    "event_fingerprint": "58d2811b80cbae489059c47e68b6be7f37f6936c",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "tls",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
        "payload_hash": "d8c72716451e2cce06acfe197bb7731f",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 85,
        "service": "tls",
        "service_name": "tls",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003V\ufffd\ufffd\ufffd\ufffd\u05c7(7\ufffdg\ufffd\ufffd:\ufffd\ufffd\u05ac\u0011\ufffd\ufffd\u000f\ufffd\ufffd\ufffd1\ufffdzF\ufffd\ufffd\ufffd \ufffd\u0016K?\ufffd\ufffd\ufffd;\u001e\ufffd\ufffd\u0013\u0537\n\ufffdU=b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd*ar\u001d\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003V\ufffd\ufffd\ufffd\ufffd\u05c7(7\ufffdg\ufffd\ufffd:\ufffd\ufffd\u05ac\u0011\ufffd\ufffd\u000f\ufffd\ufffd\ufffd1\ufffdzF\ufffd\ufffd\ufffd \ufffd\u0016K?\ufffd\ufffd\ufffd;\u001e\ufffd\ufffd\u0013\u0537\n\ufffdU=b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd*ar\u001d\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \"\ufffd\ufffd\ufffd\ufffd\ufffd8o\u0016>\ufffdB\u00004\ufffd?\ufffd\ufffd\u0002\ufffdx=\ufffd\ufffdFFw\ufffdC",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003V\ufffd\ufffd\ufffd\ufffd\u05c7(7\ufffdg\ufffd\ufffd:\ufffd\ufffd\u05ac\u0011\ufffd\ufffd\u000f\ufffd\ufffd\ufffd1\ufffdzF\ufffd\ufffd\ufffd \ufffd\u0016K?\ufffd\ufffd\ufffd;\u001e\ufffd\ufffd\u0013\u0537\n\ufffdU=b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd*ar\u001d\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "80b84a049c7a871243860aab6d5b14b154a205f4",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003V\ufffd\ufffd\ufffd\ufffd\u05c7(7\ufffdg\ufffd\ufffd:\ufffd\ufffd\u05ac\u0011\ufffd\ufffd\u000f\ufffd\ufffd\ufffd1\ufffdzF\ufffd\ufffd\ufffd \ufffd\u0016K?\ufffd\ufffd\ufffd;\u001e\ufffd\ufffd\u0013\u0537\n\ufffdU=b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd*ar\u001d\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
        "port": 85,
        "service": "tls",
        "service_label_fr": "TLS"
    },
    "evidence_snippet": "\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffd\u05c7(7\ufffdg\ufffd\ufffd:\ufffd\ufffd\u05ac\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffdzF\ufffd\ufffd\ufffd \ufffdK?\ufffd\ufffd\ufffd;\ufffd\ufffd\u0537\n\ufffdU=b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd*ar\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via TLS:85 \u00b7 (sonde \/ probe)",
    "target_port_label": "85 \u00b7 TLS",
    "emulator_service": "tls",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "tls",
        "service_label_fr": "TLS",
        "dst_port": 85,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-tls",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003V\ufffd\ufffd\ufffd\ufffd\u05c7(7\ufffdg\ufffd\ufffd:\ufffd\ufffd\u05ac\u0011\ufffd\ufffd\u000f\ufffd\ufffd\ufffd1\ufffdzF\ufffd\ufffd\ufffd \ufffd\u0016K?\ufffd\ufffd\ufffd;\u001e\ufffd\ufffd\u0013\u0537\n\ufffdU=b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd*ar\u001d\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "tls_ja3": "7c1e207beb00684bbbe144f1b0abe1d5",
            "port": 85,
            "service": "tls",
            "service_label_fr": "TLS"
        },
        "attack_vector": "postgres probe \u00b7 via TLS:85 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdV\ufffd\ufffd\ufffd\ufffd\u05c7(7\ufffdg\ufffd\ufffd:\ufffd\ufffd\u05ac\ufffd\ufffd\ufffd\ufffd\ufffd1\ufffdzF\ufffd\ufffd\ufffd \ufffdK?\ufffd\ufffd\ufffd;\ufffd\ufffd\u0537\n\ufffdU=b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdt\ufffd*ar\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "85 \u00b7 TLS",
        "emulator_service": "tls",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "tls",
        "service_banner": "honeypot-tls",
        "service_os": "linux",
        "dst_port": "85"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 5,
    "multi_protocol_sample": [
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_ja3",
        "tls_no_sni",
        "tls_weak_cipher"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 258,
    "payload_entropy": 5.846566594532186,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "http-alt-81",
    "app_proto": "http-alt-81",
    "asn": 12876,
    "country": "FR",
    "dst_port": 81,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "78af023cf79e2cc551b3bc717eee4762bcf624d5",
    "event_fingerprint": "da8b22a909c287a6570bb2c7dce20fa4de2070cb",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-81",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "34596966da56c614aa7127e0599d58aa",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 81,
        "service": "http-alt-81",
        "service_name": "http-alt-81",
        "risk_score": 42
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\u0000\ufffdm\"\ufffd\u04d2QL\ufffd\n\ufffd\ufffd\u001eC\ufffd*\ufffd\ufffd\ufffd\u000b\ufffd\/Z \ufffd\ufffd%lc\ufffdp\ufffdm'\ufffd\b^\ufffdf\ufffdu\t}r;\ufffd\u0014\ufffd_\ufffd5v\ufffd\t\/\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\u0000\ufffdm\"\ufffd\u04d2QL\ufffd\n\ufffd\ufffd\u001eC\ufffd*\ufffd\ufffd\ufffd\u000b\ufffd\/Z \ufffd\ufffd%lc\ufffdp\ufffdm'\ufffd\b^\ufffdf\ufffdu\t}r;\ufffd\u0014\ufffd_\ufffd5v\ufffd\t\/\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffda;3\ufffdE\ufffd\ufffd\ufffd\u000e\u0016\ufffd\u0019\ufffd\u001e\ufffdf]\ufffd\ufffd5v@\ufffd\ufffdS\/\u0016\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\u0000\ufffdm\"\ufffd\u04d2QL\ufffd\n\ufffd\ufffd\u001eC\ufffd*\ufffd\ufffd\ufffd\u000b\ufffd\/Z \ufffd\ufffd%lc\ufffdp\ufffdm'\ufffd\b^\ufffdf\ufffdu\t}r;\ufffd\u0014\ufffd_\ufffd5v\ufffd\t\/\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bf0ab8be7248c4e880f5072e644bd3383d77949b",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\u0000\ufffdm\"\ufffd\u04d2QL\ufffd\n\ufffd\ufffd\u001eC\ufffd*\ufffd\ufffd\ufffd\u000b\ufffd\/Z \ufffd\ufffd%lc\ufffdp\ufffdm'\ufffd\b^\ufffdf\ufffdu\t}r;\ufffd\u0014\ufffd_\ufffd5v\ufffd\t\/\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
        "port": 81,
        "service": "http-alt-81",
        "service_label_fr": "HTTP ALT 81"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffdm\"\ufffd\u04d2QL\ufffd\n\ufffd\ufffdC\ufffd*\ufffd\ufffd\ufffd\ufffd\/Z \ufffd\ufffd%lc\ufffdp\ufffdm'\ufffd^\ufffdf\ufffdu\t}r;\ufffd\ufffd_\ufffd5v\ufffd\t\/&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "port scan syn \u00b7 via HTTP ALT 81:81 \u00b7 (reconnaissance)",
    "target_port_label": "81 \u00b7 HTTP ALT 81",
    "emulator_service": "http-alt-81",
    "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP ALT 81 \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 8
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "http-alt-81",
        "service_label_fr": "HTTP ALT 81",
        "dst_port": 81,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-81",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\u0000\ufffdm\"\ufffd\u04d2QL\ufffd\n\ufffd\ufffd\u001eC\ufffd*\ufffd\ufffd\ufffd\u000b\ufffd\/Z \ufffd\ufffd%lc\ufffdp\ufffdm'\ufffd\b^\ufffdf\ufffdu\t}r;\ufffd\u0014\ufffd_\ufffd5v\ufffd\t\/\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000",
            "port": 81,
            "service": "http-alt-81",
            "service_label_fr": "HTTP ALT 81"
        },
        "attack_vector": "port scan syn \u00b7 via HTTP ALT 81:81 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdA\ufffd\ufffd\ufffdm\"\ufffd\u04d2QL\ufffd\n\ufffd\ufffdC\ufffd*\ufffd\ufffd\ufffd\ufffd\/Z \ufffd\ufffd%lc\ufffdp\ufffdm'\ufffd^\ufffdf\ufffdu\t}r;\ufffd\ufffd_\ufffd5v\ufffd\t\/&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "81 \u00b7 HTTP ALT 81",
        "emulator_service": "http-alt-81",
        "confidence_reason": "Confiance 100 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_81",
        "service_banner": "honeypot-http-alt-81",
        "service_os": "linux",
        "dst_port": "81"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
    "emulator_response_len": 63,
    "bytes_in": 60,
    "payload_entropy": 4.62973742089034,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "rtsp",
    "app_proto": "rtsp",
    "asn": 12876,
    "country": "FR",
    "dst_port": 554,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "c612347518e049ce96c448df76dc171f725494ef",
    "event_fingerprint": "ce3db5ba4bd31f163b31f656bd467795f2c32ce9",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 231,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0382",
        "pat-0420"
    ],
    "matched_pattern_names": [
        "RTSP protocol",
        "HTTP OPTIONS method"
    ],
    "pattern_ids": [
        "pat-0382",
        "pat-0420"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "rtsp",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5d3225774492d17b91d6d1043fc0956f",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 554,
        "service": "rtsp",
        "service_name": "rtsp",
        "risk_score": 42
    },
    "payload_preview": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSPScanner\/1.0\r\n\r\n",
    "request_sample": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSPScanner\/1.0\r\n\r\n",
    "payload_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSPScanner\/1.0",
    "evidence": {
        "request_sample": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSPScanner\/1.0\r\n\r\n",
        "payload_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSPScanner\/1.0",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e533c8afd1e415b4e079c1d3a0807d0554e08278",
    "protocol_details": {
        "payload_preview": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSPScanner\/1.0",
        "port": 554,
        "service": "rtsp",
        "service_label_fr": "RTSP"
    },
    "evidence_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSPScanner\/1.0",
    "attack_vector": "port scan syn \u00b7 via RTSP:554 \u00b7 (reconnaissance)",
    "target_port_label": "554 \u00b7 RTSP",
    "emulator_service": "rtsp",
    "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RTSP \u2014 multi-protocole (6 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "rtsp",
        "service_label_fr": "RTSP",
        "dst_port": 554,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rtsp",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "payload_preview": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSPScanner\/1.0",
            "port": 554,
            "service": "rtsp",
            "service_label_fr": "RTSP"
        },
        "attack_vector": "port scan syn \u00b7 via RTSP:554 \u00b7 (reconnaissance)",
        "evidence_snippet": "OPTIONS * RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: RTSPScanner\/1.0",
        "target_port_label": "554 \u00b7 RTSP",
        "emulator_service": "rtsp",
        "confidence_reason": "Confiance 100 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rtsp",
        "service_banner": "honeypot-rtsp",
        "service_os": "linux",
        "dst_port": "554"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 4,
    "port_scan_ports_sample": [
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 3,
    "scan_velocity_ports_per_s": 30,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 6,
    "multi_protocol_sample": [
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rtsp_probe",
        "rtsp_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1196,
    "payload_entropy": 4.8579102755223555,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 12876,
    "country": "FR",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 42,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "f3554ab0de9c062a9bac7457058dc7da59129aee",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 42,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "253db52e6fddebd044efb6d26859b39f",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 42
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\ufffd\u0006\u0014\ufffdi\ufffd\ufffd\ufffd\t-\ufffd\ufffd:\ufffd\ufffd\u0207\ufffdI\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\ufffd\u0006\u0014\ufffdi\ufffd\ufffd\ufffd\t-\ufffd\ufffd:\ufffd\ufffd\u0207\ufffdI\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\ufffd\u0006\u0014\ufffdi\ufffd\ufffd\ufffd\t-\ufffd\ufffd:\ufffd\ufffd\u0207\ufffdI\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0004\ufffd\u0006\u0014\ufffdi\ufffd\ufffd\ufffd\t-\ufffd\ufffd:\ufffd\ufffd\u0207\ufffdI\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0004\ufffd\u0006\u0014\ufffdi\ufffd\ufffd\ufffd\t-\ufffd\ufffd:\ufffd\ufffd\u0207\ufffdI\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7615dd049f567e61bb0e79f5f9908f9a049f3678",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\ufffd\u0006\u0014\ufffdi\ufffd\ufffd\ufffd\t-\ufffd\ufffd:\ufffd\ufffd\u0207\ufffdI\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-",
        "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\ufffd\u0006\u0014\ufffdi\ufffd\ufffd\ufffd\t-\ufffd\ufffd:\ufffd\ufffd\u0207\ufffdI\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdi\ufffd\ufffd\ufffd\t-\ufffd\ufffd:\ufffd\ufffd\u0207\ufffdIcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-",
    "attack_vector": "port scan syn \u00b7 via SSH:22 \u00b7 (reconnaissance)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH \u2014 multi-protocole (7 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 42,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "ssh_banner": "SSH-2.0-Go\r\n\u0000\u0000\u0004\ufffd\u0006\u0014\ufffdi\ufffd\ufffd\ufffd\t-\ufffd\ufffd:\ufffd\ufffd\u0207\ufffdI\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-",
            "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0004\ufffd\u0006\u0014\ufffdi\ufffd\ufffd\ufffd\t-\ufffd\ufffd:\ufffd\ufffd\u0207\ufffdI\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "port scan syn \u00b7 via SSH:22 \u00b7 (reconnaissance)",
        "evidence_snippet": "SSH-2.0-Go\r\n\ufffd\ufffdi\ufffd\ufffd\ufffd\t-\ufffd\ufffd:\ufffd\ufffd\u0207\ufffdIcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 6 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 5,
    "port_scan_ports_sample": [
        22,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 4,
    "scan_velocity_ports_per_s": 12.09,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 7,
    "multi_protocol_sample": [
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_slow",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20",
    "emulator_response_len": 45,
    "bytes_in": 9,
    "payload_entropy": 2.4193819456463714,
    "port_category": "well_known",
    "org": "Scaleway SAS",
    "service": "telnet",
    "app_proto": "telnet",
    "asn": 12876,
    "country": "FR",
    "dst_port": 23,
    "risk_waf": 8,
    "risk_classification": 64,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "fc4ac0fcfa9adfa6ade4acd6ac91474ecf79b4ee",
    "event_fingerprint": "79b983d64b1c5573cc70fb9163374500a6810d67",
    "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 293,
    "precision_signals": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "kb_rule_ids": [
        "MITRE-T1046",
        "SIGMA-net-port-scan",
        "INT-beh-scan-burst",
        "INT-beh-multi-port-60s"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 64,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "telnet",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0cb068ca98a7def3ed494f99e4258483",
        "path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
    },
    "target_context": {
        "dst_port": 23,
        "service": "telnet",
        "service_name": "telnet",
        "risk_score": 42
    },
    "payload_preview": "\ufffd\ufffd\u0001\ufffd\ufffd\u0003\ufffd\ufffd\u0018",
    "request_sample": "\ufffd\ufffd\u0001\ufffd\ufffd\u0003\ufffd\ufffd\u0018",
    "payload_snippet": "\ufffd\ufffd\u0001\ufffd\ufffd\u0003\ufffd\ufffd\u0018",
    "evidence": {
        "request_sample": "\ufffd\ufffd\u0001\ufffd\ufffd\u0003\ufffd\ufffd\u0018",
        "payload_snippet": "\ufffd\ufffd\u0001\ufffd\ufffd\u0003\ufffd\ufffd\u0018",
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "recon",
    "mitre_tactics": [
        "TA0043"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2cdf765e92bc0677cd7d1f1ef228c131a6b9b9ff",
    "protocol_details": {
        "payload_preview": "\ufffd\ufffd\u0001\ufffd\ufffd\u0003\ufffd\ufffd\u0018",
        "port": 23,
        "service": "telnet",
        "service_label_fr": "Telnet"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
    "attack_vector": "port scan syn \u00b7 via Telnet:23 \u00b7 (reconnaissance)",
    "target_port_label": "23 \u00b7 Telnet",
    "emulator_service": "telnet",
    "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via Telnet \u2014 multi-protocole (8 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 64,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 18
        },
        "attack_stage": "recon",
        "attack_stage_label": "Reconnaissance",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "telnet",
        "service_label_fr": "Telnet",
        "dst_port": 23,
        "protocol_emulated": true,
        "tags_summary": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "INT-beh-scan-burst",
            "INT-beh-multi-port-60s"
        ],
        "tags_summary_labels_fr": [
            "MITRE-T1046",
            "SIGMA-net-port-scan",
            "Beh Scan Burst",
            "Beh Multi Port 60S"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-telnet",
        "correlation_flags": [
            "scan_rapide",
            "campagne_ports",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan rapide multi-ports",
            "Campagne multi-ports",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "payload_preview": "\ufffd\ufffd\u0001\ufffd\ufffd\u0003\ufffd\ufffd\u0018",
            "port": 23,
            "service": "telnet",
            "service_label_fr": "Telnet"
        },
        "attack_vector": "port scan syn \u00b7 via Telnet:23 \u00b7 (reconnaissance)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd",
        "target_port_label": "23 \u00b7 Telnet",
        "emulator_service": "telnet",
        "confidence_reason": "Confiance 100 % \u2014 3 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "telnet",
        "service_banner": "honeypot-telnet",
        "service_os": "linux",
        "dst_port": "23"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "port_scan_campaign": true,
    "port_scan_distinct_ports": 6,
    "port_scan_ports_sample": [
        22,
        23,
        81,
        85,
        554,
        25461
    ],
    "rapid_port_scan": true,
    "rapid_scan_distinct_ports": 5,
    "scan_velocity_ports_per_s": 1.65,
    "multi_protocol_correlation": true,
    "multi_protocol_count": 8,
    "multi_protocol_sample": [
        "http-alt-81",
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp",
        "ssh",
        "telnet",
        "tls"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "port_scan_campaign",
        "rapid_port_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_slow",
        "net_telnet_probe",
        "telnet_emulated"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Scaleway SAS",
    "service": null,
    "app_proto": null,
    "asn": 12876,
    "country": "FR",
    "dst_port": 25461,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "ef847759946c165f4f06b380ab2007c4cd8987af",
    "event_fingerprint": "bffdf787fd92bf66cd6346ee06291039751b4d60",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "FR",
        "asn": 12876,
        "org": "Scaleway SAS",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 25461,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "327358276d875189cbacad72104353ff603644d6",
    "protocol_details": {
        "port": 25461
    },
    "attack_vector": "Sonde port \u00b7 port 25461 \u00b7 (sonde \/ probe)",
    "target_port_label": "25461",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 25461,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 25461
        },
        "attack_vector": "Sonde port \u00b7 port 25461 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "25461",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "25461"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 4,
    "multi_protocol_sample": [
        "http-alt-8880",
        "port:17000",
        "port:25461",
        "rtsp"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}