64.89.161.90

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 104,
    "payload_entropy": 5.069920585376531,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 205759,
    "country": "US",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2c1af289dcc35b18a85603169cb3e735",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46Y29tMTIz\r\n\r\n",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46Y29tMTIz\r\n\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46Y29tMTIz",
    "evidence": {
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46Y29tMTIz\r\n\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46Y29tMTIz",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ff2752b64fd4ba56004bc3d932a413f00a4ea409",
    "protocol_details": {
        "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46Y29tMTIz",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46Y29tMTIz",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46Y29tMTIz",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46Y29tMTIz",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 100,
    "payload_entropy": 4.956663821422317,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 205759,
    "country": "US",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d0077f5104d658db90be91868d12bc72",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4\r\n\r\n",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4\r\n\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4",
    "evidence": {
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4\r\n\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "60a3d5b82c0db2dab74bed5ae4a9eefc159b0ca2",
    "protocol_details": {
        "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 108,
    "payload_entropy": 5.271046359677068,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 205759,
    "country": "US",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f813e256c92d3e0dc217eae1ff437607",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm91dGVyOmFkbWluIUAj\r\n\r\n",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm91dGVyOmFkbWluIUAj\r\n\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm91dGVyOmFkbWluIUAj",
    "evidence": {
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm91dGVyOmFkbWluIUAj\r\n\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm91dGVyOmFkbWluIUAj",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2d67f5a264fe1257ae73cb3d7e48a229ab3196b6",
    "protocol_details": {
        "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm91dGVyOmFkbWluIUAj",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm91dGVyOmFkbWluIUAj",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm91dGVyOmFkbWluIUAj",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm91dGVyOmFkbWluIUAj",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ]
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 9551,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bdf835de27870e0661da9dadb3450213cd8ada5c",
    "event_fingerprint": "6a24161fae58fe6c8b37393931f03811fe22cf18",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9551,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "49de1fcb157d224a52e3f0a24c6e40ea04c95862",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 9551
    },
    "attack_vector": "Sonde port \u00b7 port 9551 \u00b7 (sonde \/ probe)",
    "target_port_label": "9551",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9551,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 9551
        },
        "attack_vector": "Sonde port \u00b7 port 9551 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9551",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9551"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 9551,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "feefc027b794e0cd4d86da4f5485d19aed307dc3",
    "event_fingerprint": "244c85b1c85e36599fbd877e46b25aa58c4ed990",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 9551,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e18967b05a08ee47e188da3a54291a4732340346",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 9551
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 9551 \u00b7 (sonde \/ probe)",
    "target_port_label": "9551",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9551,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 9551
        },
        "attack_vector": "proxy probe \u00b7 port 9551 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "9551",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9551"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ]
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 9551,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "cb65565e72eca0debfa8fa519bac209eadffb0dc",
    "event_fingerprint": "be227ec6f654c47dc6e93d2269edf070d14136cf",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9551,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "aa293e6e8d2fa3bdbafb74e102fb2f35e49bfb2d",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 9551,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:9551 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "9551 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9551,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 9551,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:9551 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "9551 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9551"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:9551"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 9551,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "bdf835de27870e0661da9dadb3450213cd8ada5c",
    "event_fingerprint": "6a24161fae58fe6c8b37393931f03811fe22cf18",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 9551,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "301c908e8dd7463cd23ecd8619df7ce3a46b3d21",
    "protocol_details": {
        "port": 9551
    },
    "attack_vector": "Sonde port \u00b7 port 9551 \u00b7 (sonde \/ probe)",
    "target_port_label": "9551",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 9551,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 9551
        },
        "attack_vector": "Sonde port \u00b7 port 9551 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9551",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "9551"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 2342,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "ac5a83afc3bba0f77e8e05da4818b7d945e9ff5f",
    "event_fingerprint": "2b6efbd9817980828206d4119429c0c18942038f",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2342,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f452d10dd1a27cd50932783b92cbdc07097d976a",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 2342
    },
    "attack_vector": "Sonde port \u00b7 port 2342 \u00b7 (sonde \/ probe)",
    "target_port_label": "2342",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2342,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 2342
        },
        "attack_vector": "Sonde port \u00b7 port 2342 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2342",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2342"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2342",
        "port:3135"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 2342,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "ca23f56b2bed00538e86ee8dfc2abf2f91dad3df",
    "event_fingerprint": "dde526e583a764ecca0d66c468567efae442d9ec",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 2342,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a57376f2e7593e52ea57cb39ace944b05dab040a",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 2342
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 2342 \u00b7 (sonde \/ probe)",
    "target_port_label": "2342",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2342,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 2342
        },
        "attack_vector": "proxy probe \u00b7 port 2342 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "2342",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2342"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2342",
        "port:3135"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ]
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 2342,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "d5db690b9ebffccd852c8726e9e9ce69c0198fc1",
    "event_fingerprint": "00c3fa52453f96cea0d42b4c7f846dd33449e27c",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 2342,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "08b5e68e32fcbb52fd68217cc9896dd059776292",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 2342,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:2342 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "2342 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 2342,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 2342,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:2342 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "2342 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "2342"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2342",
        "port:3135"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 2342,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "ac5a83afc3bba0f77e8e05da4818b7d945e9ff5f",
    "event_fingerprint": "2b6efbd9817980828206d4119429c0c18942038f",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 2342,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7c6e52f6c57f798781fd144c809b32d5fa09c711",
    "protocol_details": {
        "port": 2342
    },
    "attack_vector": "Sonde port \u00b7 port 2342 \u00b7 (sonde \/ probe)",
    "target_port_label": "2342",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 2342,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 2342
        },
        "attack_vector": "Sonde port \u00b7 port 2342 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "2342",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "2342"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:2342",
        "port:3135"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 3135,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "adab98bd17326ed199453674c6d7027a68af498a",
    "event_fingerprint": "10d87bc15031b9549a647dfdfa509299deca17eb",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 3135,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ad07961ab5dacf17a807a3f2a23eed54406c99f1",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 3135
    },
    "attack_vector": "Sonde port \u00b7 port 3135 \u00b7 (sonde \/ probe)",
    "target_port_label": "3135",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3135,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 3135
        },
        "attack_vector": "Sonde port \u00b7 port 3135 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "3135",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3135"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 3135,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "0fa050546fc64029e65bf2823015388694016988",
    "event_fingerprint": "be91b1b40155f5e9a6280fe0a15b9f7a78aa59e7",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 3135,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "91b1bd61b0aeff291bdab2369a8648099761d4cb",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 3135
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 3135 \u00b7 (sonde \/ probe)",
    "target_port_label": "3135",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3135,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 3135
        },
        "attack_vector": "proxy probe \u00b7 port 3135 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3135",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3135"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ]
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 3135,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "08f650f7acd8dc5019daf15f64948fcf889d4be1",
    "event_fingerprint": "071014f4f0fef7bd025085bbd36c00630b52a539",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 3135,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "21a9325434aa971c4787b5f7d06f20010a996f98",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 3135,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:3135 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "3135 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 3135,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 3135,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:3135 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "3135 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "3135"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:3135"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 3135,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "adab98bd17326ed199453674c6d7027a68af498a",
    "event_fingerprint": "10d87bc15031b9549a647dfdfa509299deca17eb",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 3135,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "728f2147a9f1fe0f7f76b32b402cdd737bb3d4ff",
    "protocol_details": {
        "port": 3135
    },
    "attack_vector": "Sonde port \u00b7 port 3135 \u00b7 (sonde \/ probe)",
    "target_port_label": "3135",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3135,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 3135
        },
        "attack_vector": "Sonde port \u00b7 port 3135 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "3135",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3135"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 6474,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "871c0b4f50d96a558ededbb6349a9a67eb127d0c",
    "event_fingerprint": "6fab7d996f3836653dd41f2df1a2768e46421180",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 6474,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bf15805f17e9308f4545d077689422a88c25e299",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 6474
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 6474 \u00b7 (sonde \/ probe)",
    "target_port_label": "6474",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6474,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 6474
        },
        "attack_vector": "proxy probe \u00b7 port 6474 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "6474",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6474"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ]
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 6474,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "54d5a21ea000bd7e7da9ff9118fe0a99f444d6b2",
    "event_fingerprint": "3f1045fe77353c67902f4440e2de315ec8308aff",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 6474,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6e542672c198629c944ef792d31a2e6505457f4e",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 6474,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:6474 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "6474 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 6474,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 6474,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:6474 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "6474 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "6474"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:6474"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 6474,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "8d626d9bbce878852d3937cc8545565e0caaee4d",
    "event_fingerprint": "e6e980a0cd2faeb7900e016e0462b8a39b92b58d",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 6474,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4f71d88543cee34da7a19477160480b6e7a26af0",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 6474
    },
    "attack_vector": "Sonde port \u00b7 port 6474 \u00b7 (sonde \/ probe)",
    "target_port_label": "6474",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6474,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 6474
        },
        "attack_vector": "Sonde port \u00b7 port 6474 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "6474",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6474"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 6474,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "8d626d9bbce878852d3937cc8545565e0caaee4d",
    "event_fingerprint": "e6e980a0cd2faeb7900e016e0462b8a39b92b58d",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 6474,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c03ddad2c97600df37b678e0fbb6394829b3a1af",
    "protocol_details": {
        "port": 6474
    },
    "attack_vector": "Sonde port \u00b7 port 6474 \u00b7 (sonde \/ probe)",
    "target_port_label": "6474",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 6474,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 6474
        },
        "attack_vector": "Sonde port \u00b7 port 6474 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "6474",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "6474"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 30290,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "56515eff1b5c2c614b442724c4e44437e8ce4efb",
    "event_fingerprint": "3f878687d24be8b683803a54ec0c8181fce2d935",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 30290,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "96a6b2a0ce0475dd17501bf1d1b0c042ad52bb9e",
    "protocol_details": {
        "port": 30290
    },
    "attack_vector": "Sonde port \u00b7 port 30290 \u00b7 (sonde \/ probe)",
    "target_port_label": "30290",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 30290,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 30290
        },
        "attack_vector": "Sonde port \u00b7 port 30290 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "30290",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "30290"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 30290,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "56515eff1b5c2c614b442724c4e44437e8ce4efb",
    "event_fingerprint": "3f878687d24be8b683803a54ec0c8181fce2d935",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 30290,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "96a6b2a0ce0475dd17501bf1d1b0c042ad52bb9e",
    "protocol_details": {
        "port": 30290
    },
    "attack_vector": "Sonde port \u00b7 port 30290 \u00b7 (sonde \/ probe)",
    "target_port_label": "30290",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 30290,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 30290
        },
        "attack_vector": "Sonde port \u00b7 port 30290 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "30290",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "30290"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420786d70705f73657276657220726561647920706f72743d353236390d0a",
    "emulator_response_len": 42,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "xmpp-server",
    "app_proto": "xmpp-server",
    "asn": 205759,
    "country": "US",
    "dst_port": 5269,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 46,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "6ce692c76dc2fefa1962c4c5266127163a321ed8",
    "event_fingerprint": "1174ca06b0d630a32ea9986362a46d3eb877699d",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "xmpp-server",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 5269,
        "service": "xmpp-server",
        "service_name": "xmpp-server",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dcd3e554a85e402f3ee80e3bb487e593988e0b04",
    "protocol_details": {
        "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "port": 5269,
        "service": "xmpp-server",
        "service_label_fr": "XMPP SERVER"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "http flood \u00b7 via XMPP SERVER:5269 \u00b7 (tentative d'exploit)",
    "target_port_label": "5269 \u00b7 XMPP SERVER",
    "emulator_service": "xmpp-server",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via XMPP SERVER",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "xmpp-server",
        "service_label_fr": "XMPP SERVER",
        "dst_port": 5269,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-xmpp-server",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
            "port": 5269,
            "service": "xmpp-server",
            "service_label_fr": "XMPP SERVER"
        },
        "attack_vector": "http flood \u00b7 via XMPP SERVER:5269 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "5269 \u00b7 XMPP SERVER",
        "emulator_service": "xmpp-server",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "xmpp_server",
        "service_banner": "honeypot-xmpp-server",
        "service_os": "linux",
        "dst_port": "5269"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420786d70705f73657276657220726561647920706f72743d353236390d0a",
    "emulator_response_len": 42,
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "xmpp-server",
    "app_proto": "xmpp-server",
    "asn": 205759,
    "country": "US",
    "dst_port": 5269,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 8,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "6ce692c76dc2fefa1962c4c5266127163a321ed8",
    "event_fingerprint": "1174ca06b0d630a32ea9986362a46d3eb877699d",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab xmpp-server \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 8
    },
    "service_name": "xmpp-server",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "5c4be8c65d327cf4843f6fc5278dcec6"
    },
    "target_context": {
        "dst_port": 5269,
        "service": "xmpp-server",
        "service_name": "xmpp-server",
        "risk_score": 8
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab xmpp-server \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1ee566f79219e64bdc804aa8a6d4bd3ff64d390d",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 5269,
        "service": "xmpp-server",
        "service_label_fr": "XMPP SERVER"
    },
    "attack_vector": "xmpp-server \u00b7 via XMPP SERVER:5269 \u00b7 (sonde \/ probe)",
    "target_port_label": "5269 \u00b7 XMPP SERVER",
    "emulator_service": "xmpp-server",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xmpp-server \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab xmpp-server \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 8,
        "risk_label": "Faible",
        "service_name": "xmpp-server",
        "service_label_fr": "XMPP SERVER",
        "dst_port": 5269,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-xmpp-server",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 5269,
            "service": "xmpp-server",
            "service_label_fr": "XMPP SERVER"
        },
        "attack_vector": "xmpp-server \u00b7 via XMPP SERVER:5269 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "5269 \u00b7 XMPP SERVER",
        "emulator_service": "xmpp-server",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "xmpp_server",
        "service_banner": "honeypot-xmpp-server",
        "service_os": "linux",
        "dst_port": "5269"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420786d70705f73657276657220726561647920706f72743d353236390d0a",
    "emulator_response_len": 42,
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "xmpp-server",
    "app_proto": "xmpp-server",
    "asn": 205759,
    "country": "US",
    "dst_port": 5269,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "f92621ea3ac6958f71f4a6f9f935b3c25a594509",
    "event_fingerprint": "a10b500dc7b872c110a2e60f898f7fbd67cc2bea",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0768"
    ],
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "xmpp-server",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ac162eba54695d7d13c3405dc0dc7492",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 5269,
        "service": "xmpp-server",
        "service_name": "xmpp-server",
        "risk_score": 35
    },
    "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0dd8b80bd625b7f07dfbd89445eaf03a4fadcd38",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
        "port": 5269,
        "service": "xmpp-server",
        "service_label_fr": "XMPP SERVER"
    },
    "evidence_snippet": "P",
    "attack_vector": "proxy probe \u00b7 via XMPP SERVER:5269 \u00b7 (sonde \/ probe)",
    "target_port_label": "5269 \u00b7 XMPP SERVER",
    "emulator_service": "xmpp-server",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "xmpp-server",
        "service_label_fr": "XMPP SERVER",
        "dst_port": 5269,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0768"
        ],
        "tags_summary_labels_fr": [
            "pat-0768"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-xmpp-server",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
            "port": 5269,
            "service": "xmpp-server",
            "service_label_fr": "XMPP SERVER"
        },
        "attack_vector": "proxy probe \u00b7 via XMPP SERVER:5269 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "P",
        "target_port_label": "5269 \u00b7 XMPP SERVER",
        "emulator_service": "xmpp-server",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "xmpp_server",
        "service_banner": "honeypot-xmpp-server",
        "service_os": "linux",
        "dst_port": "5269"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_proxy_probe",
        "socks4_greeting"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "32323020686f6e6579706f7420786d70705f73657276657220726561647920706f72743d353236390d0a",
    "emulator_response_len": 42,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "xmpp-server",
    "app_proto": "xmpp-server",
    "asn": 205759,
    "country": "US",
    "dst_port": 5269,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 0,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "6ce692c76dc2fefa1962c4c5266127163a321ed8",
    "event_fingerprint": "1174ca06b0d630a32ea9986362a46d3eb877699d",
    "classification_reason": "Type \u00ab xmpp-server \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 0,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 0
    },
    "named_classification_skipped": false,
    "service_name": "xmpp-server",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "5c4be8c65d327cf4843f6fc5278dcec6"
    },
    "target_context": {
        "dst_port": 5269,
        "service": "xmpp-server",
        "service_name": "xmpp-server",
        "risk_score": 0
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a21723b113a8288c5dfbf13aaf0de82f27e44b02",
    "protocol_details": {
        "port": 5269,
        "service": "xmpp-server",
        "service_label_fr": "XMPP SERVER"
    },
    "attack_vector": "xmpp-server \u00b7 via XMPP SERVER:5269 \u00b7 (sonde \/ probe)",
    "target_port_label": "5269 \u00b7 XMPP SERVER",
    "emulator_service": "xmpp-server",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xmpp-server \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab xmpp-server \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 0,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 0
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 0,
        "risk_label": "Faible",
        "service_name": "xmpp-server",
        "service_label_fr": "XMPP SERVER",
        "dst_port": 5269,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-xmpp-server",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 5269,
            "service": "xmpp-server",
            "service_label_fr": "XMPP SERVER"
        },
        "attack_vector": "xmpp-server \u00b7 via XMPP SERVER:5269 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "5269 \u00b7 XMPP SERVER",
        "emulator_service": "xmpp-server",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "xmpp_server",
        "service_banner": "honeypot-xmpp-server",
        "service_os": "linux",
        "dst_port": "5269"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 108,
    "payload_entropy": 5.245538142064443,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 4145,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "d7155fae81de512c7b7d514b1aa03dbca2ba0121",
    "event_fingerprint": "f6552dd30fae891444e3dd6ec7c96e2bc548357f",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ca171aa3c6e79abcbc2896868dc83c9b",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 4145,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbjAxMA==\r\n\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbjAxMA==\r\n\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbjAxMA==",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbjAxMA==\r\n\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbjAxMA==",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "86c3268cbedc7012e1c07965666f8f2ee0f68a21",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 4145,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbjAxMA==",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:4145 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "4145 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 74,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4145,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 4145,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:4145 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbjAxMA==",
        "target_port_label": "4145 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4145"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 104,
    "payload_entropy": 5.132078214671821,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 1976,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "04cc6f961c89a803ca9ae39d8fc5c9bfc816d9a8",
    "event_fingerprint": "5b3d4fd96f0d3af74d639169b31c5c01c5ca45ed",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4a9a1025ffd2264cb6c015db3c8a2468",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 1976,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=\r\n\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=\r\n\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=\r\n\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f8da8cfb99bd9b8b4aca9f2ab643cd2f259f2dca",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 1976,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:1976 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "1976 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1976,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 1976,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:1976 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=",
        "target_port_label": "1976 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1976"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:1976",
        "port:4145"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 4145,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f1981b07a565ecdb03a1465f580e17f1bf82ab5d",
    "event_fingerprint": "3dfd86b441699aa8c5da13fc14bd97bdb502407e",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 4145,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "adc2789a7fdeba62cfef15e70a9b0395fc3c7c06",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 4145
    },
    "attack_vector": "Sonde port \u00b7 port 4145 \u00b7 (sonde \/ probe)",
    "target_port_label": "4145",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4145,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 4145
        },
        "attack_vector": "Sonde port \u00b7 port 4145 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "4145",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4145"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:1976",
        "port:4145"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 4145,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "0144ddec2594bc32e254fef8a4bf56c56fcc366b",
    "event_fingerprint": "eb48a420247978e5c45183a595092bcdf57b6c63",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0768"
    ],
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ac162eba54695d7d13c3405dc0dc7492",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 4145,
        "risk_score": 35
    },
    "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "39908f98b4b1c818c2ee5d0bc45f94d3d5d2b468",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
        "port": 4145
    },
    "evidence_snippet": "P",
    "attack_vector": "proxy probe \u00b7 port 4145 \u00b7 (sonde \/ probe)",
    "target_port_label": "4145",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4145,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0768"
        ],
        "tags_summary_labels_fr": [
            "pat-0768"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
            "port": 4145
        },
        "attack_vector": "proxy probe \u00b7 port 4145 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "P",
        "target_port_label": "4145",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4145"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:1976",
        "port:4145"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ]
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 4145,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "d7155fae81de512c7b7d514b1aa03dbca2ba0121",
    "event_fingerprint": "7348ffa26e55dc8ddc7f7d4157b31be8f8c15b94",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 4145,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "72581fb8539754074ca5d35153873880855c3f68",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 4145,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:4145 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "4145 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 4145,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 4145,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:4145 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "4145 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "4145"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:1976",
        "port:4145"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 4145,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "f1981b07a565ecdb03a1465f580e17f1bf82ab5d",
    "event_fingerprint": "3dfd86b441699aa8c5da13fc14bd97bdb502407e",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 4145,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d9b69485d984e947fe897c13a741489a73c7f405",
    "protocol_details": {
        "port": 4145
    },
    "attack_vector": "Sonde port \u00b7 port 4145 \u00b7 (sonde \/ probe)",
    "target_port_label": "4145",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 4145,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 4145
        },
        "attack_vector": "Sonde port \u00b7 port 4145 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "4145",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "4145"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:1976",
        "port:4145"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 1976,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "06a614c88c8f3db6abcac71c477b334a1a4df495",
    "event_fingerprint": "74e6091dbf031686ce8e65510e2476059aa9465d",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0768"
    ],
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 35
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ac162eba54695d7d13c3405dc0dc7492",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 1976,
        "risk_score": 35
    },
    "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "18aaa1141cf71d830c743344c5a137a21a922195",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
        "port": 1976
    },
    "evidence_snippet": "P",
    "attack_vector": "proxy probe \u00b7 port 1976 \u00b7 (sonde \/ probe)",
    "target_port_label": "1976",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 1976,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0768"
        ],
        "tags_summary_labels_fr": [
            "pat-0768"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000",
            "port": 1976
        },
        "attack_vector": "proxy probe \u00b7 port 1976 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "P",
        "target_port_label": "1976",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "1976"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ]
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 1976,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "04cc6f961c89a803ca9ae39d8fc5c9bfc816d9a8",
    "event_fingerprint": "96a2b4880b7f4a944421ff39abecceb5b95abbec",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 1976,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f1ab3411edd4eec4049c4e11e479505f01b4075c",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 1976,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:1976 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "1976 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 1976,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 1976,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:1976 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "1976 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "1976"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:1976"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 1976,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "c71c4f61e28351bd2d1e33f42d5df03c05ef14e1",
    "event_fingerprint": "e0e3c5ffcffcd441a1c274a6dc16cd93ef257572",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 1976,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "af1677db7927966aaa136aff0066b518bfdf51a2",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 1976
    },
    "attack_vector": "Sonde port \u00b7 port 1976 \u00b7 (sonde \/ probe)",
    "target_port_label": "1976",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 1976,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 1976
        },
        "attack_vector": "Sonde port \u00b7 port 1976 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1976",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "1976"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": null,
    "app_proto": null,
    "asn": 205759,
    "country": "US",
    "dst_port": 1976,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "c71c4f61e28351bd2d1e33f42d5df03c05ef14e1",
    "event_fingerprint": "e0e3c5ffcffcd441a1c274a6dc16cd93ef257572",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 0,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 1976,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b7302f95944377be703529834f8c500a71efa81f",
    "protocol_details": {
        "port": 1976
    },
    "attack_vector": "Sonde port \u00b7 port 1976 \u00b7 (sonde \/ probe)",
    "target_port_label": "1976",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 0,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 1976,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 1976
        },
        "attack_vector": "Sonde port \u00b7 port 1976 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1976",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "1976"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor"
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 100,
    "payload_entropy": 5.053758880867783,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 5685,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "9bb0cbc237f6a7e3c5cb334599125809c70b1f2d",
    "event_fingerprint": "a37740404edba5d6de7ff8ea8003216c3a05c458",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ec1c77555a56a72e9134f65adc2475a6",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 5685,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0\r\n\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0\r\n\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0\r\n\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "96610481a687a56ccc444fe2e887f61b7ada23ab",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 5685,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5685 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "5685 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 74,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5685,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 5685,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5685 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0",
        "target_port_label": "5685 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5685"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 98,
    "payload_entropy": 5.087518487760639,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 5685,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "9bb0cbc237f6a7e3c5cb334599125809c70b1f2d",
    "event_fingerprint": "a37740404edba5d6de7ff8ea8003216c3a05c458",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "df701859ef9d6d67aa9cf05933e2052f",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 5685,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "02ad013e00b197343ddc0e3ccec871ae2f69a0ba",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 5685,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5685 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "5685 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 74,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5685,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 5685,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5685 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
        "target_port_label": "5685 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5685"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 106,
    "payload_entropy": 5.19815651193658,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 5685,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "9bb0cbc237f6a7e3c5cb334599125809c70b1f2d",
    "event_fingerprint": "a37740404edba5d6de7ff8ea8003216c3a05c458",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5931943520911f48ff99122d27f9e9d3",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 5685,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "755a5d218f53e203cd1c408ef3677f63b3d4749d",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 5685,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:5685 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "5685 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 74,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 5685,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 5685,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:5685 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
        "target_port_label": "5685 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "5685"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 104,
    "payload_entropy": 5.117561147322522,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 8082,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4",
    "event_fingerprint": "65cd7dc007167a7666a38c0e2221cb4ee7ec6626",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "17ea53ee647b44938037aa55d9ccd0db",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8082,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1ffe4788b878fdfd7b0f20b2a104cf9a18adcb15",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 8082,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "8082 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8082,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 8082,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
        "target_port_label": "8082 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8082"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 100,
    "payload_entropy": 5.088438191111389,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 8082,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4",
    "event_fingerprint": "65cd7dc007167a7666a38c0e2221cb4ee7ec6626",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2a17f720519423afc7fcd45ff7439891",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8082,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6d4f54d208fb20dace28a9aae5f6b0a249dee55f",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 8082,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "8082 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8082,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 8082,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
        "target_port_label": "8082 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8082"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 104,
    "payload_entropy": 5.066167128399962,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 8082,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4",
    "event_fingerprint": "65cd7dc007167a7666a38c0e2221cb4ee7ec6626",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fa2700a7b1adae0f4a7b82c2d129c972",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8082,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a4344ba05d08512b887ceb2eb3fdc302fc5717ff",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 8082,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "8082 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8082,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 8082,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
        "target_port_label": "8082 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8082"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 98,
    "payload_entropy": 5.095221421456184,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 8082,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4",
    "event_fingerprint": "65cd7dc007167a7666a38c0e2221cb4ee7ec6626",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "69577f42497958f0318fdca9cf87e651",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8082,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bHVvOmx1bw==\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bHVvOmx1bw==\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bHVvOmx1bw==",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bHVvOmx1bw==\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bHVvOmx1bw==",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2d7ad02d8507f3c17a267eb8ea98cd0f3867299c",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 8082,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bHVvOmx1bw==",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "8082 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8082,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 8082,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bHVvOmx1bw==",
        "target_port_label": "8082 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8082"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 110,
    "payload_entropy": 5.264232132873554,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 8082,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4",
    "event_fingerprint": "65cd7dc007167a7666a38c0e2221cb4ee7ec6626",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8ab3f2c21871c10cedc1fc5c4fbc6b60",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8082,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHlAMjAyNA==\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHlAMjAyNA==\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHlAMjAyNA==",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHlAMjAyNA==\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHlAMjAyNA==",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f188815f1f3d323b53714f3e3324071d19837d00",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 8082,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHlAMjAyNA==",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "8082 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8082,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 8082,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHlAMjAyNA==",
        "target_port_label": "8082 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8082"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 100,
    "payload_entropy": 5.083954380954323,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 30023,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "cf7b1181ec481dfbf3ffa15c5b776ebc35caf977",
    "event_fingerprint": "f71793bc28496942fde566223cc6ebe0434d0748",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0b3c7229dab6e4040ab364777377122d",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 30023,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c4d7559279a515c0eb240d7c13e74e77c04eaf9e",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 30023,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:30023 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "30023 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 74,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 30023,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 30023,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:30023 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
        "target_port_label": "30023 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "30023"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 102,
    "payload_entropy": 5.2311534704941005,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 30023,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "cf7b1181ec481dfbf3ffa15c5b776ebc35caf977",
    "event_fingerprint": "f71793bc28496942fde566223cc6ebe0434d0748",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "f8cb63ea79ed29f61d7f3dcad2bc48d7",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 30023,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ZGlldHBpOm5hbw==\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ZGlldHBpOm5hbw==\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ZGlldHBpOm5hbw==",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ZGlldHBpOm5hbw==\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ZGlldHBpOm5hbw==",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e9d0ab639fe7516dd4f8205197fafb0e869d96ba",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 30023,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ZGlldHBpOm5hbw==",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:30023 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "30023 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 74,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 30023,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 30023,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:30023 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic ZGlldHBpOm5hbw==",
        "target_port_label": "30023 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "30023"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "90:80",
    "http_ua_hash": null,
    "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 104,
    "payload_entropy": 5.015733354382302,
    "port_category": "registered",
    "org": "Ghosty Networks LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 205759,
    "country": "US",
    "dst_port": 8085,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843",
    "event_fingerprint": "e1ba2b9de9860d717c11232a8be20f7cadbfb54f",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 205759,
        "org": "Ghosty Networks LLC",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7910f6ff6dc7a59e7447973cba9fe93b",
        "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8085,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
    "method": "CONNECT",
    "path": "64.89.161.90:80",
    "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
    "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
    "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
    "evidence": {
        "method": "CONNECT",
        "path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
        "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "faee75e4da69778b63af24f4f69db6457f35b29c",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "64.89.161.90:80",
        "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
        "port": 8085,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
    "target_port_label": "8085 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8085,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "64.89.161.90:80",
            "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1",
            "port": 8085,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80",
        "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
        "target_port_label": "8085 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8085"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ]
}